ci(moss): (3/4) add promote_artifacts.sh helper script

[chiajunglien]

Description

PR 3 of 4: The Promotion Script Refactor (split from #5582 per review feedback).

This PR adds a reusable helper script .github/scripts/promote_artifacts.sh that encapsulates calling the Google Cloud Artifact Registry :promoteArtifact API (Exit Gate) to promote Docker image versions from a staging repository to a production repository:

• Calls projects/<project>/locations/<location>/repositories/<prod_repo>:promoteArtifact with attachment_behavior: "PUBLIC_BCID_VSA_ONLY".
• Polls the returned long-running operation until completion (done: true) and verifies no operation error occurred.
• Handles "already exists" responses idempotently.

Tests

• Verified syntax with bash -n and codespell.
• End-to-end :promoteArtifact logic verified in GitHub Actions on tpu-prod-env-multipod (maxtext-images-staging -> maxtext-images).

Checklist

Before submitting this PR, please make sure (put X in square brackets):

• I have performed a self-review of my code. For an optional AI review, add the gemini-review label.
• I have necessary comments in my code, particularly in hard-to-understand areas.
• I have run end-to-end tests tests and provided workload links above if applicable.
• I have made or will make corresponding changes to the doc if needed, including adding new documentation pages to the relevant Table of Contents (toctree directive) as explained in our documentation.

[gemini-code-assist]

Code Review

This pull request introduces a new Bash script, .github/scripts/promote_artifacts.sh, designed to promote Docker images from a staging Artifact Registry to a production repository and poll for the operation's completion. The review feedback highlights several opportunities to optimize performance and follow shell scripting best practices. Key recommendations include reusing the cached access token inside the polling loop instead of repeatedly invoking gcloud, replacing multiple Python interpreter spawns with jq for JSON construction and parsing, and using native Bash brace expansion instead of the external seq command.