Make release.yml callable: workflow_call + dry_run + RELEASE_TAG

[haydenk]

Parent

Part of #14

What to build

Refactor .github/workflows/release.yml to be callable from other workflows, without behaviour change for existing trigger paths.

• Add workflow_call trigger alongside push: tags: and workflow_dispatch
• Add dry_run input (default false) on both workflow_dispatch and workflow_call
• Introduce env.RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
• Gate the registry push and GitHub-release publish steps on ${{ !inputs.dry_run }}
• Mirror haydenk/homestead release.yml structure

Acceptance criteria

• workflow_call is invocable: a sibling workflow can call release.yml with tag input
• workflow_dispatch with dry_run=true builds without pushing or releasing
• Existing push: tags: trigger still fires the full release path
• No regressions in current matrix build/push behaviour
• Verified by manual dispatch against an existing tag with dry_run=true

Blocked by

None — can start immediately.