release: create version tags through a release-blocker gate

Problem

The release workflow starts after a v* tag is pushed, or creates a GitHub Release from an already existing target tag. It can stop GitHub Release creation, but cannot stop the release tag itself.

Required release-process change

• Replace the production tag-push entrypoint with workflow_dispatch inputs for version and target commit.
• Validate the version/ref, query open release-blocker issues, and recheck immediately before tag creation.
• Have the workflow create the version tag and GitHub Release in one controlled run.
• Define whether release tags must be GPG-signed; if so, provision an organization-owned signing identity for the release workflow.
• Add an active v* tag ruleset allowing creation only through the release bot/App.
• Keep any raw tag-trigger path non-publishing or break-glass only, and document recovery.

Operator impact

Maintainers will dispatch the release workflow instead of pushing the release tag from a workstation. Tag signing, release creation, and retries move into GitHub Actions.

Acceptance criteria

• One open release-blocker issue prevents both tag and GitHub Release creation.
• API failures fail closed.
• Dry-run validation can run without creating remote state.
• Direct v* tag creation is rejected for normal maintainers.
• Release instructions document the new path and emergency bypass.