ci: allow CI to be triggered on demand

GitHub disables re-running a workflow run once it is older than 30 days, and
both jobs run `poetry lock` against live PyPI rather than the committed
lockfile. Together that means there is no way to check whether the toolchain
has drifted since the last push — the only signal is a release tag, which
publishes.

`workflow_dispatch` makes CI re-runnable at any time. The release pipeline is
untouched: it stays tag-only, as the umbrella contract requires.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: scarmuega

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
     branches: [main]
   push:
     branches: [main]
+  # On-demand trigger: GitHub refuses to re-run a run older than 30 days, and
+  # both jobs relock against live PyPI, so drift is only observable on a fresh run.
+  workflow_dispatch:
 
 jobs:
   build: