refactor: trigger releases via workflow dispatch

[ewels]

Summary

• Releases are now triggered via workflow dispatch (GitHub UI or gh workflow run) instead of tag push
• All builds (binaries, Docker, SIMD Docker) must pass before any irreversible action
• Tag, GitHub release, and crates.io publish only happen after all builds succeed
• Dev Docker images (dev, dev-avx2, etc.) still built on every push to main

Job dependency graph

check-release                     (detects workflow_dispatch, reads version from Cargo.toml)
├── build-binaries                (always, uploads as GH Actions artifacts)
├── docker-build → docker-merge   (always)
└── docker-build-simd             (always)
        │
        ▼ all builds pass
create-tag-and-release            (release only: creates git tag + draft GH release)
├── upload-binaries               (release only: attaches artifacts to release)
└── publish-crate                 (release only: publishes to crates.io)
        │
        ▼
publish-release                   (marks release as non-draft)

Test plan

• Push to main — only dev Docker images built, no tag/release/crate
• Trigger workflow dispatch — all builds run, then tag + release + crate publish

🤖 Generated with Claude Code