Fix the release workflow's lint job, and let a failed release be re-run

[mbakalarski]

v0.0.22 — the first tag this repo ever pushed — never published. CI-with-BnP failed at lint before hatch checked a single file, so build and push were skipped and neither ghcr.io/netclab/function-eapi:v0.0.22 nor the Upbound one exists.

The failure

Environment `hatch-static-analysis` is incompatible:
module 'virtualenv.discovery.builtin' has no attribute 'propose_interpreters'

hatch 1.16.2 declares virtualenv>=20.26.6 with no upper bound, so pipx installs virtualenv 21.x, where that API is gone. It only fires when hatch has to discover an interpreter other than the one it runs on — on the runner pipx installs hatch under Python 3.12.3 while setup-python puts 3.13.14 on PATH. That is why unit-test passed and lint did not, and why the same content linted green on #16.

ci.yaml has carried pipx inject hatch "virtualenv<21" since the April "Update ci.yaml" runs, for exactly this. ci-with-bnp.yaml never got it — and, with no tag in the repo until now, had never run.

The fix

Rather than copy the workaround into a second workflow: hatch 1.17.0 raised its own floor to virtualenv>=21, i.e. it is the release that adapted to the new API. So HATCH_VERSION goes to 1.17.1 in both workflows and the pin is dropped.

Verified locally against a reproduction of the runner's interpreter mismatch (3.13 first on PATH, hatch installed by pipx under 3.12):

	result
hatch 1.16.2 + virtualenv 21.7.0	reproduces the failure verbatim, exit 1
hatch 1.16.2 + virtualenv<21	hatch fmt passes
hatch 1.17.1, no pin	hatch fmt passes; hatch test --all --randomize 2 passed

One note: 1.17 deprecates hatch fmt in favour of hatch check code --fix / hatch check fmt --fix. It still works; migrating is a separate change.

Re-running a release

ci-with-bnp.yaml triggered only on push: tags: v*, so a release that died in push could not be retried without moving the tag. Adds workflow_dispatch, gated by a guard job that refuses a ref which is not a tag — the push job already rejects one via its tag/version check, but only after the arm64 build has burned ten minutes.

🤖 Generated with Claude Code