ci(release): publish a tag only from green CI, and re-drive by tag input

[rennf93]

Closes #30

The release workflow of spring-boot-guard re-gated at the tag (a tag-push trigger and tests at the tag), after the tag was already immutable, and a manual re-drive read the ref instead of an input. This mirrors Guard-Core/guard-core-rs#156: the release workflow runs no lint or test of its own.

• verify: resolves the tag from the release event or the manual tag input (^v[0-9]+\.[0-9]+\.[0-9]+$), checks it out, compares it to the package version(s) (and refuses a -SNAPSHOT version), and requires the newest push run of ci.yml on that commit to have succeeded (it waits up to an hour).
• publish: checks the tag out explicitly and publishes to the Central Portal exactly as before (same secrets, same USER_MANAGED upload, GUARD_CORE_USE_COMPOSITE=false), skipping an artifact already on Maven Central. The pre-flight job that requires both engine artifacts live on Maven Central stays, as its own job between verify and publish, because it cannot be known earlier.

A re-drive is Actions > Release > Run workflow with the tag; it checks the tag out with master's fixed workflow. The tag-push trigger and the tests at the tag are gone.

Tested locally: actionlint clean (the only warnings are pre-existing and identical on master). I ran the CI check step against real commits: the latest release tag passes and a commit whose CI failed is refused. After merging I will dispatch the release with the current latest tag to prove the re-drive path; every package is already published, so publish skips.