release: gate tag and PyPI publication on release blockers

Problem

The release workflow publishes to PyPI on any v* tag and also on manual dispatch. A tag-triggered check is too late to stop the tag, while manual dispatch can publish without a release tag. GitHub Release creation is outside the workflow.

Related platform work: #152.

Required changes

• Make workflow_dispatch the canonical production entrypoint with version, target commit, and dry-run inputs.
• Validate CI, versions, wheels, source distribution, and supported platforms before publication.
• Query release-blocker issues early and immediately before tag/PyPI publication.
• Create the protected version tag, publish through the existing pypi environment/OIDC identity, verify PyPI, then create the GitHub Release.
• Remove or constrain direct publishing from ordinary tag pushes/manual bypasses.
• Protect v* tags and update trusted-publisher configuration if workflow identity changes.
• Document retries, recovery, and break-glass access.

Acceptance criteria

• One open release-blocker issue prevents tag, PyPI, and GitHub Release publication.
• API failures fail closed.
• Dry-run validates all artifacts without publication.
• #152 remains linked so platform expansion matches release coverage.
• Direct protected-tag creation is rejected.