The publish jobs build and copy the wheels to the AFS r/w partitions,
but they are not released to the mirrors until a final "vos release"
of their volume.
Previously this happened in a final job that would not trigger if any
of the wheel builds failed. This has meant thing like out-of-sync
centos mirrors or arm64 node failures have stopped all wheel
publishing previously. There's really no need to block other
platforms publishing if one of these jobs fails.
This converts the jobs to have a release job syncrhonized by a
semaphore. We don't want many "vos release" processes running all at
once, as it has been a source of failure with openafs before. Since
releasing requires the admin key, we keep it in a separate job from
the building.
Change-Id: I10c307c2d46c0e5b86732943208c3167da28a694
47d99524c5