ci: Gate manual release workflows on wait-for-checks (#907)

## Summary

Ports the CI consolidation and `wait-for-checks` adoption from
`crawlee-python` to `apify-sdk-python`. See
[apify/crawlee-python#1913](https://github.com/apify/crawlee-python/pull/1913)
for the original rationale and PR description; the follow-up permission
fixes from [#1914](https://github.com/apify/crawlee-python/pull/1914)
and [#1915](https://github.com/apify/crawlee-python/pull/1915) are baked
in here.

Two commits:

1. **Consolidate check workflows into a single Checks workflow** —
merges `_check_code.yaml`, `_check_docs.yaml`, `_check_package.yaml`,
and `_tests.yaml` into a single `_checks.yaml`. Every check now carries
the shared `Checks /` prefix. `unit_tests`, `integration_tests`, and
`e2e_tests` are gated on a `run_tests` input so `on_master.yaml` can
keep skipping tests for docs-only commits.
2. **Gate manual release workflows on wait-for-checks** — replaces the
inline `code_checks` step in `manual_release_stable.yaml` /
`manual_release_beta.yaml` / `manual_release_docs.yaml` /
`manual_version_docs.yaml` with an
`apify/actions/wait-for-checks@v1.2.0` step that verifies the `Checks`
workflow already passed on the dispatch commit (it runs via
`on_master.yaml` on every push). Every reusable-workflow caller that
ends up requesting `checks: read` (docs jobs in `on_master.yaml`,
`version_docs` / `doc_release` in `manual_release_stable.yaml`,
`doc_release_post_publish` in `manual_release_beta.yaml`) explicitly
grants the permission, since reusable workflows are capped at the
caller's permission set.