Add ref input and enforce main-only stable releases

[lbebber]

Summary

• Adds a ref text field to the Release workflow dispatch form so users can type a branch name to release from, instead of using the branch dropdown
• Enforces that stable versions (X.Y.Z) can only be released from main — non-main branches require a prerelease version (X.Y.Z-alpha.1, etc.)
• Works with both the new ref input and the existing branch dropdown (backward compatible)
• Improves run-name to show the version and ref in the workflow run list

How it works

• effectiveRef() resolves the target branch from ref input (if set) or the dispatch branch
• validateDispatch() rejects stable versions when the effective ref isn't main
• tagAndDispatch() resolves HEAD for tagging when a custom ref is used (since github.sha belongs to the dispatch branch, not the checked-out ref)
• assertCheckoutSha / assertOriginMainSha are skipped for custom refs (they compare against github.sha which doesn't apply)

Test plan

• All existing and new unit tests pass
• Dispatch a dry-run from main with ref=<branch> and a prerelease version — should succeed
• Dispatch a dry-run from main with ref=<branch> and a stable version — should fail validation
• Dispatch a release from main with no ref input — should work as before