ci: automate renderdiff golden image updates (#9740)

- Introduces the `RDIFF_ACCEPT_NEW_GOLDENS` commit message tag.
- Conditionally skip the `test-renderdiff` presubmit comparison
  if this tag is present.
- Extracts renderdiff generation into a reusable
  `.github/actions/renderdiff-generate` composite action.
- Modifies `postsubmit-main.yml` to automatically generate new
  goldens and push them to a temporary
  `accept-goldens-<short-hash>` branch before merging them into
  `main` when the tag is found.

test/renderdiff/README.md

@@ -114,6 +114,24 @@ Doing the above has multiple effects:
 - If the PR is merged, then there is another workflow that will merge `my-pr-branch-golden`
   to the `main` branch of the golden repo.
 
+### Automated update via commit message
+
+Alternatively, if you are confident in your changes and want the CI to handle the update
+for you, you can use the following tag in your commit message:
+
+- In the commit message of your working branch on `filament`, add the following line:
+  ```
+  RDIFF_ACCEPT_NEW_GOLDENS
+  ```
+
+This has the following effects:
+- The presubmit test `test-renderdiff` will be bypassed (it will not perform rendering or
+  comparison).
+- When the PR is merged, the postsubmit CI will automatically:
+    1. Build Filament and generate the new images.
+    2. Upload them to a temporary branch in `filament-assets`.
+    3. Merge that branch into `main`.
+
 ## Viewing test results
 
 We provide a viewer for looking at the result of a test run. The viewer is a webapp that can