ci: allow building a dev image from a branch without cutting a release

[mayankpande88]

Problem

Diagnosing the external HTTP/2 failure has required five prereleases (v0.1.6-rc.1 … rc.5) purely to get an image onto dev. release.yml only triggers on v* tags, and ci.yml builds no image at all — so there is currently no way to test a branch.

That has two costs beyond the wasted tags:

1. It manufactures real GitHub releases for throwaway diagnostic builds.
2. The deploy workflow in nudgebee-infra resolves the newest version-shaped tag from GHCR, so every RC becomes eligible for automatic deployment to dev. That hazard is live — a workflow_dispatch run at 08:30Z picked up an RC.

Change

Adds workflow_dispatch to release.yml. Dispatched runs publish dev-<branch> and dev-<shortsha> and nothing else.

Neither matches ^[0-9]+\.[0-9]+\.[0-9]+, so they are invisible to the infra resolver, and the type=semver patterns stay gated on tag pushes — latest, 0.1 and 0 never move.

Two steps that had to be gated

Both would have misbehaved on a dispatch, and neither is obvious from a skim:

• Verify tag is on main compares GITHUB_SHA against origin/main. Correct policy for a release, but it would block dispatching from a branch — the entire purpose here.
• Create GitHub release with binaries uses github.ref_name as the release name with make_latest: true. On a dispatch that is a branch name, so it would publish a GitHub release named after the branch and mark it the latest release.

Tag sanitisation

Tags come from type=ref/type=sha rather than a raw value: branch names contain / (diag/http2-frame-direction), which is not a legal Docker tag. metadata-action sanitises it. A raw ${{ github.ref_name }} would have failed the build.

Testing

YAML validated. Not exercised end-to-end — the first dispatch run is the test, and it is low-risk: worst case the build fails and no tag moves, since every release-affecting step is gated to push.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.