don't strictly rely on github releases to tag with dispatch-releases

The dispatch-releases feature implicitly relies on the fact that GitHub Releases automatically creates a tag if you ask it to create a GitHub Release for a given tag name, which we do.

However when **only** hosting with axo Releases, that means we won't create a tag at all. Conceptually this is an easy fix. Just add the following here:

https://github.com/axodotdev/cargo-dist/blob/c1526bc57ce4da5c33fa31072ae3bdcd96f7dc94/cargo-dist/templates/ci/github/release.yml.j2#L593

```yaml
{{%- elif workflow_dispatch or release_branch %}}
# TODO: if github releases are disabled AND we're using a non-tag-first workflow,
# then we're responsible for creating and pushing the tag!
- name: "tag commit"
run: |
git tag ${{ needs.plan.outputs.tag }}
git push origin tag ${{ needs.plan.outputs.tag }}
{{%- endif %}}
```

But the exact details of how we invoke git here might want to be refined.