ci(release): publish a tag only from green CI, and re-drive by tag input

[rennf93]

Closes #145

The release workflow of guard-core-ts re-gated at the tag (a tag-push trigger and tests at the tag), after the tag was already immutable, and a manual re-drive read the ref instead of an input. This mirrors Guard-Core/guard-core-rs#156: the release workflow runs no lint or test of its own.

• verify: resolves the tag from the release event or the manual tag input (^v[0-9]+\.[0-9]+\.[0-9]+$), checks it out, compares it to the package version(s) (all five @GuardCore packages), and requires the newest push run of ci.yml, ecosystem-gate.yml and live-smoke.yml on that commit to have succeeded (it waits up to an hour).
• publish: checks the tag out explicitly, builds and publishes each package with provenance through npm trusted publishing, skipping any version already on npm (npm view). ci.yml no longer filters push runs by path, so a docs-only tagged commit still gets the run verify requires.

A re-drive is Actions > Release > Run workflow with the tag; it checks the tag out with master's fixed workflow. The tag-push trigger and the tests at the tag are gone.

Tested locally: actionlint clean (the only warnings are pre-existing and identical on master). I ran the CI check step against real commits: the latest release tag passes and a commit whose CI failed is refused. After merging I will dispatch the release with the current latest tag to prove the re-drive path; every package is already published, so publish skips.