chore: move ci-base-image publishing out of merge.yml and into its own branch

[mattheworris]

Changing ci-base-image requires a 2-step process, such that in step 1 the image is published and in step 2 an additional PR is required to update any github workflows that have changed.

Moving publishing to its own branch de-couples this 2-step process and allows for more flexibility in maintenance.

Note: the second PR usually involves the nightly-YYYY-MM-DD changing. If nightly dependence is removed, the second PR may not be necessary because the other dependence on ci-base-image is set to latest, which gets updated with each new ci-base-image version. See #1909 for tracking state of nightly dependence.