fix(release): support RC tags and selective submodules

[BitHighlander]

Summary

• accept the firmware base version tag or a numeric -rcN release-candidate suffix
• mark RC-tag releases as draft prereleases while keeping production releases draft-only until signing
• initialize only the submodules required by firmware build/test, matching CI
• avoid recursively cloning unused nested Trezor/MicroPython dependencies

Why

The first RC17 release run failed during actions/checkout before validation or builds because recursive submodule checkout attempted a shallow clone from Savannah's dumb HTTP transport:

https://github.com/BitHighlander/keepkey-firmware/actions/runs/30034659796

No firmware code changes are included.

Validation

• actionlint .github/workflows/release.yml
• YAML parser
• git diff --check
• tag cases: accepts 7.15.0, 7.15.0-rc1, 7.15.0-rc17; rejects mismatched and malformed suffixes

After this PR and its post-merge CI are green, the tested merge commit will be tagged v7.15.0-rc17 to create unsigned draft/prerelease artifacts for physical smoke testing.