ci(release): honor dry_run=false on manual dispatch; correct a download-artifact pin

[MohammadHaroonAbuomar]

What

Two release-pipeline fixes needed to append the new multi-platform Python wheels (#57) to the already-published PyPI release 0.1.0a4:

1. Honor dry_run=false on manual dispatch. Every attest/publish step was conditioned on github.ref_type == 'tag' in addition to DRY_RUN, so a workflow_dispatch with dry_run=false built everything but uploaded nothing. The workflow's only triggers are tag pushes and manual dispatch, and DRY_RUN already evaluates to false on tag pushes, so the ref_type clause only blocked the documented non-dry dispatch path. A non-dry dispatch remains gated by the release environment approval, and every registry leg is idempotent (PyPI skip-existing, crates sparse-index probe, npm npm view probe, NuGet --skip-duplicate), so re-runs and appends are safe.

2. Correct the actions/download-artifact pin in the python job. The SHA merged in ci(python): publish wheels for supported platforms #57 (3e5f45b2cfb9172054f4087a40e8e0b5a5461e7c) does not exist upstream; the job would fail at action resolution. Replaced with the real v8.0.1 commit 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c, resolved via gh api repos/actions/download-artifact/git/ref/tags/v8.0.1 — the same pin the typescript and dotnet jobs already use.

The header comment and the dry_run input description are updated to match the actual semantics.

Why now

PyPI agent-hooks-sdk 0.1.0a4 ships only a manylinux x86_64 wheel + sdist; macOS and Windows users build from source, which blocks microsoft/agent-framework#7515. sdk/python and sdk/rust are unchanged since v0.1.0-alpha.4 and every version surface on main still reads 0.1.0-alpha.4 (scripts/check-version-consistency.py passes), so a non-dry dispatch of this workflow on main will build the missing a4 wheels and append them to the existing release.

Verification

• actionlint v1.7.12 (same pin + checksum as CI): clean.
• scripts/check-version-consistency.py: version surfaces agree: 0.1.0-alpha.4.
• All action pins in the diff resolved against the upstream repos via the GitHub API.
• maturin 1.14.1 source confirms --compatibility pypi off-Linux is validated and then filtered out (resolve_platform_tags in src/build_context/builder.rs), so the never-yet-exercised macOS/Windows wheel legs from ci(python): publish wheels for supported platforms #57 are sound.