ci: remove the release workflow from 4.2, it cannot sign for oc10

[oc-tmueller]

Reverts the release workflow added in #640. My mistake in that PR — this branch ships to
ownCloud 10, and the release pipeline cannot produce an artifact oc10 accepts.

4.2 currently carries info.xml 4.2.4 and release.yml, so pushing a v4.2.4 tag today
would publish a tarball that every oc10 server rejects. No such tag exists yet.

oc10 and oc11 are different signing generations

	envelope	trust store
oc10	{hashes, signature, certificate} — legacy G1	single resources/codesigning/root.crt
oc11	{v, alg, hashes, signature, certificates} — G2	roots/root-g{1,2}.crt + intermediates/

10.16's Checker.php reads certificate in the singular and has no code path for a
v/certificates envelope, nor for the ECDSA P-384 signature G2 uses. oc11's verifier accepts
both generations, which is why the identical workflow is correct on master and wrong here.

The reusable workflow signs with ocsign, overriding the Makefile's occ integrity:sign-app.
ocsign emits G2 only — flags are --path --key --cert --chain --core --allow-vcs --out --dry-run, no legacy mode — and this repository's signing secrets hold a G2 key.

Demonstrated, not assumed

Same command, two envelope generations, two servers:

artifact	oc10 server:10.16.4	oc11 server:11.0.0
4.2.3 marketplace build — G1 envelope, max-version="10"	exit 0, no findings	exit 0, no findings
4.3.1 release build — G2 envelope, min/max-version="11"	exit 1 (below)	exit 0, no findings

$ php occ integrity:check-app richdocuments     # G2 artifact, oc10 10.16.4
Undefined index: certificate at /var/www/owncloud/lib/private/IntegrityCheck/Checker.php#353
  - EXCEPTION:
    - class: OC\IntegrityCheck\Exceptions\InvalidSignatureException
    - message: App Certificate is not valid.
exit=1

The top row rules out the obvious objection: an app declaring max-version="10" verifies fine on
11.0.0, so integrity:check-app does not consult platform compatibility. The failure is the
envelope format, at the line that reads certificate. On oc11 the G2 artifact also reports
INVALID_HASH when a signed file is tampered with, so the check is live rather than skipped.

For reference, the marketplace tarball for 4.2.3 — what oc10 admins actually install — carries a
legacy G1 envelope signed by a CN=richdocuments leaf issued by ownCloud Code Signing
Intermediate Authority.

What this means for 4.2.x releases

They stay manual: make dist plus occ integrity:sign-app with the legacy G1 key, uploaded to
the marketplace — exactly how 4.2.1, 4.2.2 and 4.2.3 shipped, none of which have GitHub release
assets. The version bump from #640 stands; only the workflow goes.

Tracking the actual 4.2.4 release separately, since it needs the G1 key.