Add dry_run mode to release workflow

[eddyashton]

The release workflow does several jobs (creating an RPM, testing we can build against the RPM, testing we can reproduce the SBOM), that currently have no coverage until we actually cut a release. This isn't ideal, meaning some errors can only be caught late. Although there's a workflow dispatch, it's designed for retrying a flaky release, and expects to be run on a real release tag (and creates a real release). I think we want a dry-run option, so we can manually derisk/smoke-test some of these steps without creating artificial GH releases.

[Copilot]

Pull request overview

Adds a dry_run option to the GitHub Actions release workflow so the release pipeline can be exercised via manual dispatch without publishing a GitHub Release.

Changes:

• Introduces workflow_dispatch boolean input dry_run (default true).
• Skips release_notes and create_release jobs when dry_run is enabled.
• Adjusts job dependencies so build_release no longer waits on release_notes.

[eddyashton]

For posterity.

How is this evaluated when the trigger is a push, not a workflow_dispatch, so inputs.dry_run doesn't exist?

When triggered by push, inputs.dry_run is undefined, which evaluates to '' (empty string) in GitHub Actions expressions. An empty string is falsy, so !inputs.dry_run evaluates to true.
This means both the release_notes and create_release jobs will run on a tag push — which is the intended behavior, since a tag push should produce a real release, not a dry run.