fix: publish assets to an existing release and allow a manual run

[requie]

Summary

The v0.1.0 release run passed every check and built all assets, then failed at the final step: the release had already been created from the GitHub UI, so the tag push found an existing release and gh release create refused (a release with the same tag name already exists: v0.1.0). The release therefore has notes but no assets.

This change makes the workflow handle that case and adds a way to attach the assets to the existing v0.1.0 release without pushing anything:

• If a release for the tag already exists, the workflow keeps its title and notes and only uploads the built assets to it (gh release upload --clobber). Otherwise it creates the release from the changelog as before.
• workflow_dispatch with a tag input checks out that tag, runs the same checks and build, and publishes the assets. Running it for v0.1.0 after this merges attaches the wheel, sdist, taxonomy JSON and YAML, schemas zip, and SHA256SUMS to the existing release.
• The final step prints the release name and asset count so the run log shows the outcome.
• docs/RELEASING.md describes both paths, and the changelog records the fix under Unreleased.

Pattern or implementation impact

None. Workflow and docs only; no code, pattern, case, registry, or generated-file changes.

Safety impact

• Authorized targets only
• Synthetic data and identities only
• Mock tools, sinks, and actuators only
• No destructive payload, real exfiltration, persistence, or approval bypass

No test content changes. The manual trigger only uploads to a release that already exists for the given tag and runs the full checks on that tag first.

Validation

• Generated files are current
• Repository validation passes
• Unit tests pass (release-script tests rerun)
• Secure mock passes (unchanged)
• Vulnerable synthetic behavior fails when an executable case changes (no executable case changes)
• Workflow YAML parses with both push and workflow_dispatch triggers
• Commit includes DCO sign-off