Release workflow never fires on release-please tags -- every release ships zero assets

[forkwright]

Finding

release.yml triggers only on push: tags: ["v*"] and has never run -- total_count of runs against that workflow is 0. Every recent release (v0.6.1, v0.6.0, v0.5.0, v0.4.4, v0.4.3, v0.4.2) ships with zero assets: no binaries, no checksums, no SBOM, no provenance attestation.

Evidence

• gh api repos/forkwright/akroasis/releases --jq '.[0:6][]|{tag:.tag_name,assets:(.assets|length)}' -> all six releases show assets: 0.
• gh api repos/forkwright/akroasis/actions/workflows/245346829/runs --jq '{total_count,runs:.workflow_runs}' -> total_count: 0. release.yml (workflow id 245346829) has never executed, tag-triggered or otherwise.
• release-please.yml's reusable call (forkwright/.github/.github/workflows/release-please.yml@main) resolves its token as secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN. gh api repos/forkwright/akroasis/actions/secrets --jq '{total_count}' (repo admin access) -> total_count: 0: no RELEASE_PLEASE_TOKEN secret exists here, so every tag push is authored with the default GITHUB_TOKEN.
• GitHub's own recursion guard means a push authored by the default GITHUB_TOKEN cannot trigger further workflow runs -- release.yml's on: push: tags was never going to fire regardless of how many release-please tags landed.
• Same root cause, already diagnosed and partially fixed in Release workflow never fires on release-please tags — v0.2.3 shipped without binary assets harmonia#709 (workflow_dispatch added to release.yml, an attest-release-source job added to release-please.yml).

Why this matters

The release train is supposed to produce attested binaries per release. Right now every cut ships source-only (not even that -- zero assets of any kind), silently, because the trigger that's supposed to fire it structurally cannot.

Desired correction

Ported harmonia's partial fix in #<PR_NUMBER_PLACEHOLDER>:

• release.yml gains a workflow_dispatch trigger (with a WHY comment naming the recursion-guard mechanism), giving it a manual firing path and a re-run mechanism.
• release-please.yml gains an attest-release-source job, gated on needs.release-please.outputs.release_created == 'true', that runs automatically off the existing push-to-main trigger -- so a signed CycloneDX SBOM and build-provenance attestation for the source archive land on every release-please-created release without anyone dispatching anything.

This does not fully close the gap: release.yml's binary matrix build still needs someone to run gh workflow run release.yml --ref <tag> by hand after each cut, matching harmonia#709's own still-open status (its "Done when" -- a release cut needs no manual dispatch for binaries to land -- remains unmet there too, months after its partial fix landed). That's real remaining debt, not solved by this issue.

Done when: workflow_dispatch exists on release.yml and an attest-release-source job exists on release-please.yml, and a real tag-triggered release run (via manual dispatch) is observed producing binaries + checksums, closing the loop this issue's evidence shows has never once fired.

[forkwright]

Fix opened: #475 (the placeholder text in the issue body above refers to it).