ci: fix npm upgrade in publish job + add workflow_dispatch fallback

[ktamas77]

Summary

• Replace the broken npm install -g npm@latest step (Node 22.22.2's bundled npm corrupts itself mid-install with Cannot find module 'promise-retry') with npx -y npm@11.5.2 publish --provenance --access public. This still satisfies the Trusted Publisher OIDC requirement of npm >= 11.5.1 without trying to upgrade the global npm.
• Add a workflow_dispatch trigger with a tag input so a failed publish can be re-run against an existing tag (e.g. v0.1.3) without having to bump versions.

Why

• The 0.1.3 publish run failed at npm install -g npm@latest, leaving the tag created on git but never pushed to npm. Once this lands, dispatching the workflow with tag=v0.1.3 will publish 0.1.3 to npm.

Test plan

• After merge, run gh workflow run release.yml -f tag=v0.1.3 and confirm npm view @squidcode/timebook version reports 0.1.3.

[codemouseai]

In workflow_dispatch, inputs.tag is passed directly to actions/checkout as ref, which can be any branch/commit/ref string, not necessarily a release tag. This makes it possible to accidentally (or intentionally) publish arbitrary code to npm instead of an immutable release tag.

Suggested change

	with:
	ref: refs/tags/${{ inputs.tag }}

Fix prompt (copy to your AI agent)

Update `.github/workflows/release.yml` so manual publish only accepts real tags: use `ref: refs/tags/${{ inputs.tag }}` (not raw input), and add a validation step before publish that fails unless `inputs.tag` matches your release pattern (for example `^v[0-9]+\.[0-9]+\.[0-9]+$`) and exists in `refs/tags/`.