release: gate tag and package publication on release blockers

Problem

Current release process pushes master and a v* tag manually, publishes the GitHub Release in the UI, then runs Attach Packages to Release. The workflow starts after the release is public, so it cannot block the tag or release.

Required changes

• Add a canonical workflow_dispatch release entrypoint with version, target commit, and dry-run inputs.
• Build/test all DEB, RPM, MSI, PKG, and DMG artifacts before publication.
• Query open release-blocker issues early and recheck immediately before creating remote release state.
• Create the annotated/signed tag, GitHub Release, and attachments through the controlled workflow.
• Refactor the existing package workflow into a reusable workflow where useful.
• Protect v* tags so normal maintainers cannot bypass the workflow.
• Update MAINTENANCE.md, including recovery and break-glass steps.

Process impact

Maintainers will prepare/merge the version bump and dispatch Actions instead of pushing tags and publishing GitHub Releases manually.

Acceptance criteria

• One open release-blocker issue prevents tag, GitHub Release, and package publication.
• API failures fail closed.
• Dry-run produces validated artifacts without public state.
• Direct protected-tag creation is rejected for normal maintainers.