Fix windows-arm64 GUI release builds

[ihadeed]

Summary

• Pin and verify a llvm-mingw aarch64 toolchain (20260616, sha256 checked) on the windows-11-arm gui-release leg only, prepend its bin to PATH, and set CC/CXX to its clang wrappers — the runner's default gcc is x86-only and can't assemble arm64 (no such instruction: stp x29,x30), which is what broke run 29646239351 on tag v2.1.1.
• Add a workflow_dispatch trigger with a required tag input that re-runs only gui-validate and gui-release against an existing tag (checkout ref and the asset/upload tag both come from the input), guarding validate/release to skip on dispatch. Lets a failed GUI leg be re-published without cutting a new tag.
• Tag-push path is unchanged: validate/release/gui-validate/gui-release all still run exactly as before, using github.ref/github.ref_name where the dispatch path uses the input.

Test plan

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))" parses cleanly
• actionlint passes with no findings
• Traced both trigger paths by hand (tag push vs. workflow_dispatch)
• Windows-arm64 leg itself can't be exercised locally — needs a real dispatch or tag push to confirm the toolchain fixes the build

[ihadeed]

Reviewed before merge: llvm-mingw asset verified as the native aarch64 host toolchain with sha256 matched against the live release; trigger-path logic traced for both tag-push (unchanged behavior) and dispatch (gui jobs only, tag threaded through checkout, asset naming, and upload); input quoting checked for shell injection. No blocking findings.