fix(ci): always publish on manual main workflow dispatch

[JSONbored]

Summary

Eliminates flaky manual publish behavior by making CI / Sure-AIO workflow-dispatch runs on main always execute the publish path, without relying on a sometimes-misread checkbox input.

What changed

• remove publish_image input from .github/workflows/build.yml
• update CI gate resolver (scripts/ci_flags.py) so:
  • push on main => publish enabled
  • workflow_dispatch on main => publish enabled
  • workflow_dispatch on non-main => publish disabled
• keep run_smoke_test as optional/manual for dispatch runs
• update CI gate tests in scripts/test-ci-flags.py to cover the new dispatch semantics
• update .github/workflows/release.yml to stop passing removed publish_image input when triggering CI / Sure-AIO

Why

• manual workflow runs were repeatedly completing with publish skipped even when users selected publish options
• this caused repeated operational failures and unnecessary maintenance loops
• deterministic dispatch behavior is required for reliable release operations

Validation

• python3 scripts/test-ci-flags.py
• python3 scripts/ci_flags.py --event-name workflow_dispatch --ref refs/heads/main --run-smoke-test-input false
  • confirms publish_requested=true
• PYTHONPYCACHEPREFIX=/tmp/sure-aio-pyc python3 -m py_compile scripts/ci_flags.py scripts/test-ci-flags.py scripts/release.py scripts/validate-template.py scripts/check-upstream.py scripts/update-template-changes.py
• python3 scripts/validate-template.py

Notes

• After merge, a manual CI / Sure-AIO run on main will publish by default.
• run_smoke_test remains optional.
• This does not create a new release/version; it fixes publish control flow reliability.