Fix Docker publish release recovery

[abmmhasan]

Summary

Adds a safe recovery path for missed Docker publish release events without changing the proven release trigger/concurrency structure used successfully by docker-runner.

What changed

• keep release: types: [published], weekly schedule, and docker-publish concurrency unchanged
• add optional workflow_dispatch.inputs.release_tag
• when a manual release tag is supplied, resolve and validate that exact published stable GitHub release
• publish the immutable release tag + latest through the normal release path
• leave empty manual dispatch behavior unchanged: refresh latest only
• extend release-contract tests so manual release recovery cannot regress

Context

Release 0.4 was published but no release-event Docker Publish run was created. A later manual dispatch was accepted by GitHub but the old workflow could only refresh latest, so it could not recover the missing 0.4 image tag.

The Runner repository was checked as a control: its current workflow uses the same top-level release trigger and concurrency structure and successfully published Runner 0.5 today, so this change does not alter those proven parts.