ci: add safe release preflight

[arthur-goldblatt]

What changed

• Install ripgrep in the release build before running tests, matching the normal unit-test workflow.
• Allow the release workflow to run manually as a build-only preflight.
• Restrict the PyPI publish job to real v* tag pushes so a manual preflight can never publish.
• Skip tag/version matching only for manual preflight runs.

Root cause

The first v0.1.0 release run failed before building or publishing because the release runner did not install ripgrep. Fifteen tests that exercise allowlisted rg commands failed with Allowlisted command is not installed: rg; 765 tests passed.

Failed run: https://github.com/cisco-foundation-ai/antares-cli/actions/runs/32298577884

Impact

This aligns release-test dependencies with pull-request CI and provides a safe way to execute the exact release build path before replacing the failed v0.1.0 tag.

Local validation

• uv run pytest -q -p no:cacheprovider — 779 passed, 1 skipped
• uv run ruff check src tests tools
• uv run mypy src
• uv build
• Provider-neutral wheel verification passed
• yamllint passed using .github/linters/.yamllint.yml

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None