ci(server): server-release-watch — rc-line moves + rc tags for the embedded-server source

[gustavorps]

Problem

The embedded server (terminusdb-bin) now defaults to the official terminusdb/terminusdb repo with auto-resolved refs (see the TERMINUSDB_CODE_SOURCE PR). Nothing alerts maintainers when the auto-resolved rc line moves or when a pin-worthy v<major>.<minor>-rc tag is published — a silent-version-drift risk.

Changes

• scripts/server-release-watch.sh — mirrors build.rs TERMINUSDB_CODE_SOURCE semantics:
  • --source or the TERMINUSDB_CODE_SOURCE env selects any repo (official default; /tree/<branch|tag> URLs resolve explicitly — forks included)
  • auto mode resolves the highest <major>.<minor>-rc branch; reports v<major>.<minor>-rc tags
  • exit 2 when the rc line moved past --expected-branch (default 12.1-rc) or an rc tag appeared; --json for CI
• .github/workflows/server-release-watch.yml — weekly cron (Mon 09:00 UTC) + workflow_dispatch; opens/updates a [release-watch] issue with TERMINUSDB_CODE_SOURCE pin guidance (…/tree/<ref>)

Verification

• Live-tested: auto default resolves 12.1-rc (ok); explicit fork tag URL (…/tree/v12.0.6-paraplu.1) explicit mode; --expected-branch=stale-branch → status: moved, exit 2, actionable pin message; --json shape validated

Notes

• Pure CI/observability — no build behavior change; the companion TERMINUSDB_CODE_SOURCE PR carries the resolver