fix(ci): dispatch the binary release build from release-please itself

[forkwright]

Finding

release.yml's on: push: tags: trigger has never fired. release-please
pushes the release tag using a workflow-issued token (RELEASE_PLEASE_TOKEN
or the fallback GITHUB_TOKEN), and GitHub's recursion guard drops workflow
triggers from events that a workflow-issued token produces. The workflow's
own header comment already documented this; the only working path to
platform binaries has been the workflow_dispatch fallback, run by hand.
Nobody has run it since v0.3.0.

#709 named this exact root cause.

Evidence

$ gh api repos/forkwright/harmonia/releases/tags/v0.4.2 --jq '.assets[].name'
harmonia-v0.4.2.tar.gz
harmonia-v0.4.2.tar.gz.cdx.intoto.jsonl
harmonia-v0.4.2.tar.gz.cdx.json
harmonia-v0.4.2.tar.gz.provenance.intoto.jsonl
harmonia-v0.4.2.tar.gz.sha256

Same 5 source/SBOM/provenance assets, zero harmonia-*-{x86_64,aarch64}-*
binary tarballs, on v0.4.0, v0.4.1, and v0.4.2 — three releases running.
Contrast v0.3.0, which carries 15 additional binary-related assets (3
platforms × 5 files each) from the one hand-run dispatch.

$ gh api repos/forkwright/harmonia/actions/workflows/245346811/runs \
    --jq '.workflow_runs[] | {created_at,event,conclusion}'
{"created_at":"2026-08-12T15:38:47Z","event":"workflow_dispatch","conclusion":"success"}
{"created_at":"2026-07-15T16:02:25Z","event":"workflow_dispatch","conclusion":"failure"}
{"created_at":"2026-07-07T09:24:26Z","event":"workflow_dispatch","conclusion":"success"}
{"created_at":"2026-07-06T20:56:21Z","event":"workflow_dispatch","conclusion":"failure"}
{"created_at":"2026-07-06T19:12:13Z","event":"workflow_dispatch","conclusion":"failure"}

5 runs total, all workflow_dispatch, none push. Most recent 2026-08-12,
despite v0.4.0 (08-19), v0.4.1 (08-24), v0.4.2 (08-26) all publishing since.

Why this matters

The release train is supposed to produce attested platform binaries per
release; instead it quietly ships source-only releases unless a human
remembers a manual step that has a 100% miss rate since the last time
someone happened to run it.

Desired correction

Dispatch release.yml from inside release-please.yml's own
release_created-gated job, the same pattern attest-release-source
already uses successfully — that job runs in the push-to-main context
(not the tag push), so it isn't subject to the recursion guard, and it has
fired reliably on every release since it was added.

trigger-binary-release calls gh workflow run release.yml --ref <tag_name> with a job-scoped actions: write token, so the dispatch fires
unconditionally on every release_created == true, no memory required.

Done when: a release cut needs no manual dispatch for binaries to
land — verified by the next release-please merge producing binary assets
without anyone running workflow_dispatch by hand.

Closes #709