ci: support manual release publication

[jrandolf]

Summary

• add a manual release dispatch for an existing tag
• check out the selected tag in every verification and publication job
• keep automatic tag-push releases unchanged

This provides a safe recovery path when GitHub suppresses downstream workflows for tags created by the workflow token.

Verification

• mise exec -- hk check --all --slow
• actionlint, ghalint, zizmor, yamllint, ShellCheck, cargo check, Clippy, and cargo-deny passed through hk