v2.4.0

ci: add workflow_dispatch release trigger (#7)

## Summary
- Adds `workflow_dispatch` to `release.yml` with a `bump:
patch|minor|major` choice input
- Computes the next semver from the latest `v*` tag, tags HEAD, and
pushes — then goreleaser runs in the same job (so no PAT needed;
`GITHUB_TOKEN`-pushed tags don't trigger downstream workflows)
- Existing `push: tags` path is preserved for manual `git push origin
vX.Y.Z`
- Guarded so dispatch only runs from `master`

## Test plan
- [ ] Actions → release → Run workflow on `master` with `bump=patch`
produces the next tag and a goreleaser run
- [ ] Manual `git tag vX.Y.Z && git push --tags` still triggers the
existing path

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Changes the release pipeline to create and push git tags
automatically, which can unintentionally cut releases or bump the wrong
version if misused. Risk is somewhat mitigated by restricting manual
dispatch runs to `master` and keeping the existing tag-push trigger.
> 
> **Overview**
> Adds a manual `workflow_dispatch` trigger to the `release` GitHub
Actions workflow with a `bump` input (`patch|minor|major`).
> 
> On manual runs, the workflow now computes the next `v*` semver tag
from the latest existing tag, creates and pushes that tag (guarded to
only run from `master`), then proceeds with the existing
GoReleaser-based release flow; the original `push: tags` trigger remains
unchanged.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
eae184a0d24e72646f119ce9a68e92c49134819f. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>