chore(release): fix release workflow to republish existing tags

[francoischalifour]

Summary

• Add a manual workflow_dispatch path to the release workflow so existing release tags can be rebuilt and republished without waiting for a new main push.
• Gate the release-please job to push events only, while allowing the publish job to run for either a freshly created release or an explicitly requested tag.
• Build artifacts from the requested ref, upload the tag-specific binaries, and scope checksums/attestations to the Darwin and Linux release outputs that are actually published.
• Update the 1.0.0 changelog date to reflect the release timeline used by this branch.