ci: require manual release publishing

[decofe]

Summary

• Split release preparation from release publishing so main pushes only open/update the release PR.
• Require manual workflow_dispatch for GitHub release creation and build dispatch.
• Prevent tag pushes from publishing release assets unless the build workflow was manually dispatched for that tag.

Prompted by: @alexrisch

Verification

• uv run --with pyyaml python - <<'PY' ... parsed all workflow YAML files
• pnpm changelog:validate

Notes

This does not change GitHub repository settings. The release environment still needs required reviewers configured in GitHub settings for a stronger approval gate.