ci: dispatch release build from release-on-publish workflow

GitHub recorded release published at 16:44:21Z but no release.yml run
started. A thin release-on-publish workflow listens for publish and starts
release.yml via workflow_dispatch (always creates a run). release.yml now
checks out vX.Y.Z from the version input, not main HEAD.

Co-Authored-By: Cursor <cursoragent@cursor.com>

.github/workflows/release.yml

@@ -1,14 +1,10 @@
 name: release
 
 # Publishes an immutable, version-tagged image on ghcr.io (spec 10.1).
-# Ordinary commits and bare git tag pushes do not publish anything. The
-# workflow runs when a GitHub Release is published (not while it is still a
-# draft), or on workflow_dispatch with an explicit SemVer X.Y.Z version. A
-# dispatch from main without that input must fail in prepare — it must not
-# publish ghcr.io/...:main. The version is the single source that goes into
-# both the image tag and the panel binary's -ldflags version, so the two can
-# never drift apart (the invariant restore's version check in spec 7.5.A
-# depends on).
+# Ordinary commits and bare git tag pushes do not publish anything. A published
+# GitHub Release starts release-on-publish.yml, which dispatches this workflow
+# with the release version. You can also run it manually via workflow_dispatch
+# with an explicit SemVer X.Y.Z version.
 #
 # Native per-architecture builds (see docs/development.md), not qemu:
 # running the full Postfix/OpenDKIM stack under emulation for the e2e gate
@@ -20,13 +16,11 @@ name: release
 # in the registry as a side effect (harmless — the version tag's immutability,
 # spec 10.1, is about that tag, not these).
 on:
-  release:
-    types: [published]
   workflow_dispatch:
     inputs:
       version:
-        description: "Image version as X.Y.Z (no v prefix). Required on workflow_dispatch."
-        required: false
+        description: "Image version as X.Y.Z (no v prefix)."
+        required: true
         type: string
 
 permissions:
@@ -43,22 +37,18 @@ jobs:
         id: version
         env:
           INPUT_VERSION: ${{ github.event.inputs.version }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
           EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
           raw="${INPUT_VERSION:-}"
-          if [ -z "$raw" ] && [ "${EVENT_NAME}" = "release" ] && [ -n "${RELEASE_TAG:-}" ]; then
-            raw="${RELEASE_TAG}"
-          fi
           raw="${raw#v}"
           if ! [[ "$raw" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::release version is not SemVer X.Y.Z (event=${EVENT_NAME}; release tag=${RELEASE_TAG:-none}; pass inputs.version on workflow_dispatch). Refusing to publish ghcr.io/${{ github.repository }}:${raw:-?}"
+            echo "::error::release version is not SemVer X.Y.Z (event=${EVENT_NAME}; pass inputs.version on workflow_dispatch). Refusing to publish ghcr.io/${{ github.repository }}:${raw:-?}"
             exit 1
           fi
           #region agent log
           echo "::group::agent-log prepare version"
-          echo "event=${EVENT_NAME} release_tag=${RELEASE_TAG:-none} version=${raw}"
+          echo "event=${EVENT_NAME} version=${raw} checkout_ref=v${raw}"
           echo "::endgroup::"
           #endregion
           echo "version=${raw}" >> "$GITHUB_OUTPUT"
@@ -77,7 +67,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.release.tag_name || github.ref }}
+          ref: v${{ needs.prepare.outputs.version }}
 
       - uses: docker/setup-buildx-action@v3
 
@@ -144,7 +134,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.release.tag_name || github.ref }}
+          ref: v${{ needs.prepare.outputs.version }}
 
       - name: Debug — snapshot GitHub Release state (agent)
         env: