chore(release): promote v1.6.1-rc.1 -> v1.6.1 - #3550

…se-1.6 (#3893)

v1.6.1 was promoted with the rc e2e gate bypassed, and its promote PR
body says so verbatim. The reason is mechanical rather than anyone's
judgement call: workflows run from the ref they fire on, release-1.6's
`tags.yaml` has no `rc-e2e` job and this branch has no `e2e-tag.yaml` at
all, so when `v1.6.1-rc.1` was pushed there was nothing to produce
evidence the gate could find. Bypass was the only outcome available.

This closes that. Adds `e2e-tag.yaml` verbatim from main, which works as
written here because `hack/e2e-chainsaw/` and the `test-chainsaw` target
already exist on this branch. Splices main's `rc-e2e` job into
`tags.yaml`. Adds the `verify-release-candidate` job to
`pull-requests.yaml`, and the candidate-verification step to
`pull-requests-release.yaml` positioned before tag creation, publish and
retag. Plus `hack/verify-promoted-packages.sh`,
`hack/lib/promoted-packages.sh`, `hack/validate-changelog.sh` and two
bats suites.

All five files `promote-rc.yaml`'s preflight demands are present now
with their markers, where this branch previously satisfied one of five.
The e2e job name is kept byte-identical because promote-rc matches on
exactly that string, and `hack/promote-gate-contract.bats` now pins the
pair so the next drift gets a red test instead of a silent bypass.

One deviation worth knowing about. The verify job is keyed on author
plus a `release-` head branch, not on the presence of the `release`
label. On #3550 the PR was created at 09:35:31Z and the label arrived as
a separate `labeled` event at 09:35:32Z, and this branch's
`on.pull_request.types` has no `labeled`, so a label-keyed job would
satisfy the preflight marker and then never fire. Adding `labeled` was
the other option but on main it is interlocked with a concurrency split,
a `plan` guard complement and `e2e-fork.yaml`, so keying on the author
is the narrower change. Checked against every release-labelled bot PR
back to v1.0.7, the bot's other release PRs use `changelog-v*` heads so
they do not collide.

…VM disks (#4431)

Backport of #3455 to `release-1.6`.

Management etcd on this branch stalls under the VM-heavy suites the same
way main did before #3455: every operator loses its lease in the same
few seconds, and install failed on it in #3550 and #3905. Second commit
widens tenant node-join deadline from 12m to 18m. Most kubernetes suite
failures on 1.6 are workers that get their CSR signed 6-9 minutes after
VMI start and miss the 12m window, the script step already has 40m so
the wider wait fits.

Both commits cherry-picked clean with `-x`.

### Testing

- `make unit-tests` green, POSIX sh sweep clean.
- Real check is E2E on this PR.

```release-note
NONE
```