fix(release): declare workflow_dispatch inputs (dry-run guard inert) + consolidate build-docker/build-and-push (from #628)

[hyperpolymath]

Context

Follow-ups from #628 (which scoped Release & Container down to the surviving cli image). Two pre-existing defects in .github/workflows/release.yml were left untouched so they'd get their own review.

1. workflow_dispatch inputs are referenced but never declared → dry-run guard is inert

The trigger block declares no inputs:

on:
  push: null
  workflow_dispatch: null

…yet the workflow references two inputs that therefore never exist:

• inputs.version (lines ~39–40): the manual-version path is dead — it always falls through to the tag-derived VERSION.
• inputs.dry_run (lines ~204, 228, 237, 253): every gate is ${{ !inputs.dry_run }}. With dry_run undeclared it is always falsy, so !inputs.dry_run is always true — meaning a "dry run" can never be selected; every dispatch/push actually pushes images and publishes the release.

Fix: declare the inputs so the guard works:

on:
  push:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version (overrides tag)"
        type: string
        required: false
      dry_run:
        description: "Build only; do not push images or publish the release"
        type: boolean
        default: true

(Confirm the desired dry_run default — true is the safer default for a manual publish pipeline; leaving it false preserves today's always-publish behaviour but keeps the option.)

2. build-docker / build-and-push matrix duplication

Post-#628 both matrices target only cli and do overlapping ghcr login/metadata/build work. Consolidate into a single job (or make one clearly the PR-build / other the publish path) to remove the duplication.

Validation to run

• actionlint clean on the edited file (baseline had 10 pre-existing findings incl. the dangling inputs.* — declaring the inputs should remove those).
• A workflow_dispatch run with dry_run=true must build and not push / not create a release.