ci(release): add workflow_dispatch trigger

Lets us re-run the release pipeline against an existing tag
without force-pushing the tag. Push the tag triggers the run
normally; workflow_dispatch is for retries after an infra-side
fix (e.g. enabling attestation by flipping the repo public).

Author: imanimanyara

.github/workflows/release.yml

@@ -3,6 +3,9 @@ name: Release
 on:
   push:
     tags: ['v*']
+  # Manual re-runs against an existing tag without force-pushing. Set
+  # `ref` to the tag (e.g. `v0.2.0`) when dispatching.
+  workflow_dispatch:
 
 permissions:
   contents: write    # upload release assets