[FSSDK-13238] ci: validate release PRs and allow manual release retries

[muzahidul-opti]

Summary

• Run release.yml on PRs that change Sources/Utils/SDKVersion.swift, in validate-only mode: the version format must be valid and CHANGELOG.md must have a ## <version> section. It exits before tagging or publishing.
• Add a workflow_dispatch trigger so a failed release can be retried from Actions → Release → Run workflow. A manual run reads the branch's latest commit, which picks up any fixes merged after the failure.
• Restrict manual and push runs to master and release/**, so nobody can publish a release from a feature branch.

While testing on a fork, a release PR that was merged without its CHANGELOG section failed the release job. Re-running didn't help, because re-runs check out the original commit (GITHUB_SHA). Merging a CHANGELOG fix didn't trigger the job either, because of the SDKVersion.swift path filter. The only way out was a manual gh release create. With this change, a PR missing its CHANGELOG section fails before merge, and transient failures can be retried from the UI.

On pull_request, the job still declares contents: write. PRs from forks get a read-only token anyway, and same-repo branches come from people who already have write access.

Test plan

• actionlint passes.
• Tested on fork muzahidul-opti/swift-sdk: merging a version bump with a CHANGELOG entry published v5.5.1. A bump without one failed, and re-running kept failing (the case this PR fixes).
• After merge: check that a release PR without a CHANGELOG section fails the publish check, a PR with one passes ("ready to release"), and a manual run on master for an existing tag prints "already released".

Issues

• FSSDK-13238

🤖 Generated with Claude Code