ci: dispatch release build from release-on-publish workflow

GitHub recorded release published at 16:44:21Z but no release.yml run
started. A thin release-on-publish workflow listens for publish and starts
release.yml via workflow_dispatch (always creates a run). release.yml now
checks out vX.Y.Z from the version input, not main HEAD.

Co-Authored-By: Cursor <cursoragent@cursor.com>

.github/workflows/release-on-publish.yml

@@ -0,0 +1,46 @@
+name: release-on-publish
+
+# Listens for a published GitHub Release and starts release.yml via
+# workflow_dispatch. GitHub documents that workflow_dispatch always creates a
+# new run (even when triggered by GITHUB_TOKEN), unlike some release:published
+# deliveries that never started release.yml in this repo (see repo events API
+# 2026-08-14T16:44:21Z vs Actions run list).
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  actions: write
+  contents: read
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Derive SemVer from release tag
+        id: version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+          raw="${RELEASE_TAG#v}"
+          if ! [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::release tag is not SemVer vX.Y.Z (${RELEASE_TAG})"
+            exit 1
+          fi
+          #region agent log
+          echo "::group::agent-log release-on-publish"
+          echo "release_tag=${RELEASE_TAG} version=${raw} release_id=${{ github.event.release.id }} draft=${{ github.event.release.draft }}"
+          echo "::endgroup::"
+          #endregion
+          echo "version=${raw}" >> "$GITHUB_OUTPUT"
+
+      - name: Start release workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh workflow run release.yml \
+            --repo "${{ github.repository }}" \
+            --ref main \
+            -f "version=${{ steps.version.outputs.version }}"