- workflow_dispatch: add publish_release (bool) + release_tag inputs
- push tag native-v*: upload to its release as before
- manual + publish_release: validate release_tag is native-v*, upload to that release
- artifact upload still runs unconditionally
- workflow_dispatch input tag -> optional ref (branch or tag)
- empty ref falls back to the branch selected in the UI
- tag-format validation now only runs on push events