ci(release): create stable/X.Y.x line branch on X.Y.0 tags (#29457)

Each patch release currently spawns an ad-hoc patch/v1.84.N branch
that exists only to base the next patch's cherry-picks on, leaving
stale per-patch branches behind and making "what is queued for the
next 1.84.x" hard to answer. Switch to one long-lived line branch
per minor, stable/X.Y.x, created automatically the first time we
tag X.Y.0 on that minor, and tagged on for each subsequent patch.

The gate is ^v?(\d+)\.(\d+)\.0$, so rc / dev / nightly / .post /
patch tags all skip cleanly; the line branch is created exactly
once per minor. Existing release/<tag> behavior is untouched
(additive step), and RC patches keep their current patch/v1.87.0rcN
flow until that gets its own follow-up.

.github/workflows/create-release-branch.yml

@@ -63,3 +63,28 @@ jobs:
               sha: commitHash,
             });
             core.info(`Created branch ${branchName} at ${commitHash}`);
+
+      - name: Create stable line branch
+        env:
+          TAG: ${{ inputs.tag }}
+          COMMIT_HASH: ${{ inputs.commit_hash }}
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const tag = process.env.TAG;
+            const commitHash = process.env.COMMIT_HASH;
+
+            const match = tag.match(/^v?(\d+)\.(\d+)\.0$/);
+            if (!match) {
+              core.info(`Tag ${tag} is not the X.Y.0 stable opener; skipping stable line branch`);
+              return;
+            }
+            const lineBranch = `stable/${match[1]}.${match[2]}.x`;
+
+            await github.rest.git.createRef({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: `refs/heads/${lineBranch}`,
+              sha: commitHash,
+            });
+            core.info(`Created branch ${lineBranch} at ${commitHash}`);