ci(release): let the floating-tag job run on a dispatch, and say what it covers

[vyncint]

Closes #30.

The ruleset half (already applied)

protect-release-tags covered refs/tags/v* — both kinds of tag, which want opposite treatment:

tag	what it is	immutable?
v2.0.0	names a published, immutable set of crates	yes
v2	a pointer whose contract is to move	no

Protecting the pointer against being moved is why float-major-tag had never once worked. 2.0.0 was its first run — on a creation, the case only a major bump produces — and it was rejected outright:

remote: error: GH013: Repository rule violations found for refs/tags/v2.
remote: - Cannot create ref due to creations being restricted.

Narrowed to refs/tags/v*.*.*. Every existing release tag (v1.0.0 … v2.0.0) keeps creation/update/deletion/non-fast-forward protection; v1 and v2 fall outside, so the job needs no bypass. Rules, enforcement and the admin bypass are byte-identical — only the condition changed.

I chose this over adding the Actions bot to the bypass actors, which would have handed the workflow the ability to delete or rewrite a release tag — a strictly larger permission than the problem needs.

The workflow half (this PR)

float-major-tag was gated on push && ref_type == 'tag', so the resume path RELEASING documents — "part-way through the eight crates: re-run release.yml by dispatch" — skipped it. A resumed release finished with @vN still on the previous version, which is precisely what the job exists to prevent. That hole is independent of the ruleset and would have outlived it.

It now runs on dispatch too, given the tag it is finishing. A dispatch can be handed anything, so the tag is checked to exist and to look like a release tag before a floating pointer is aimed at it.

Verification

actionlint clean. I will dispatch it against v2.0.0 after merge — it is idempotent (publish skips what is on the registry, and re-pointing v2 at the commit it already names is a no-op), and it is the only way to prove the bot can now move the tag, since I hold the admin bypass myself and my own push proves nothing.

Checklist

• All commits signed off
• No AI attribution trailers
• docs/RELEASING.md updated — the dispatch input, and why the ruleset stops where it does