Add /bot merge for delegated vendor profile maintainers (#15279)

* Add /bot merge for delegated vendor profile maintainers

Vendor profile PRs no longer need a maintainer with repository write access: an
account listed in the FOLDER_MERGERS variable can squash-merge a PR confined to
the folders it owns by commenting /bot merge on it. Anything reaching outside
that grant, targeting a branch other than main or release/*, or missing a green
Check profiles run is declined with a comment naming the offending files.
Grants live in the merge-delegation environment, so only an admin can change who
may merge, and MERGE_BOT_DRY_RUN stops all merging without a code change.

Check profiles now also runs on release/* pull requests; nothing else changes
for existing contributors.

* Add profile version bump to the code review checklist

Without the bump in resources/profiles/<Vendor>.json, a preset change never
reaches existing installs over the air.

.github/workflows/check_profiles.yml

@@ -1,8 +1,12 @@
 name: Check profiles
 on:
   pull_request:
+    # release/* is included because pr-merge-bot.yml lets delegates merge into
+    # it, and it gates on this workflow's result. Without it a delegated merge
+    # into a release branch would run no profile validation at all.
     branches:
     - main
+    - release/*
     paths:
     - 'resources/profiles/**'
     - ".github/workflows/check_profiles.yml"
@@ -20,6 +24,8 @@ permissions:
 
 jobs:
   check_profiles:
+    # This job name is the check-run name pr-merge-bot.yml requires before a
+    # delegated merge. Renaming it silently disables that gate.
     name: Check profiles
     runs-on: ubuntu-24.04
     steps: