release: add workflow_dispatch to release.yml for manual re-runs

[Pamperito74]

Context

`release.yml` fires only on `on: push: tags: "v*"`. If a tagged release fails partway (e.g. cosign outage, npm registry 5xx), there's no clean re-run path short of deleting+repushing the tag.

`v0.2.4` shipped without SBOM/cosign/SLSA because Actions was temporarily disabled during the tag push — same class of problem.

Proposal

• Add `workflow_dispatch` trigger with a `tag` input to `release.yml`.
• When dispatched, use the input as `GITHUB_REF_NAME` for the tag-match check and artifact naming.
• Guard the `publish-npm` job behind a boolean input `skip_npm` (default `false`) so re-runs for an already-published version can still produce signed GH release assets without failing on `npm publish` collision.

Acceptance criteria

• `gh workflow run release.yml -f tag=v0.2.5` works end-to-end
• `-f tag=v0.2.4 -f skip_npm=true` retroactively produces SBOM + cosign + SLSA artifacts for a previously-published version and attaches them to the existing GitHub Release
• Tag-triggered runs unchanged