chore(release): cut orb-v3.7.1

[github-actions]

Proposes cutting orb-v3.7.1 (a patch release) from the current
stable release orb-v3.7.0.

Merging this PR tags orb-v3.7.1 and dispatches the image build/publish --
which still requires a release environment approval before anything reaches GHCR (see
.github/workflows/release-selfhost.yml). The daily beta channel is unaffected either way.

Image-relevant commits since the last stable release

• fix(db): map visual_capture_unobtainable_sha, so The screenshot-table gate can close PRs for evidence the bot is structurally unable to produce #9881's degrade can actually fire (fix(db): visual_capture_unobtainable_sha is written but never mapped, so #9881's degrade has never fired #10270) (fix(db): map visual_capture_unobtainable_sha, so #9881's degrade can actually fire (#10270) #10277) (12f3c6a)
• fix(queue): guard the verdict derivation instead of the pass, so the webhook path is covered (design: verdict-stability backoff guards the whole pass instead of the verdict derivation, so every bounded retry chain needs an exemption #10227) (fix(queue): guard the verdict derivation instead of the pass, so the webhook path is covered (#10227) #10276) (cb49431)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.