Fix attach-release-zip workflow: broken composer auth + packaged empty dist/

[Castellon-ACM]

Summary

PR #290 merged a workflow that turned out to be broken end-to-end — verified live against the real 1.5.2 release via the new workflow_dispatch trigger this PR adds:

• Real bug (fatal): wp package install failed every time with Your github oauth token for github.com contains invalid characters. Root cause: shivammathur/setup-php writes a github-oauth token into Composer's global auth.json (to dodge GitHub API rate limits during its own setup) that this Composer version's own validation rejects as malformed. Fixed by unsetting that config entry before installing dist-archive-command — this repo's public package install doesn't need authentication anyway.
• Real bug (packaging): the produced zip contained an empty frontblocks/dist/ folder. wp dist-archive's own --create-target-dir output (./dist) lived inside the plugin directory being archived, and .distignore has no entry for it, so it got swept into the zip. Fixed by building into ${{ runner.temp }}/dist, outside the checkout entirely.
• Adds workflow_dispatch with a tag_name input so this workflow can be tested against an already-published release without cutting a new one — this is how both bugs above were actually found and confirmed fixed, rather than discovered on the next real release.

Test plan

• Dispatched manually against the real 1.5.2 release, iterated until green
• Downloaded the resulting frontblocks-1.5.2.zip asset and confirmed: 231 files, single top-level frontblocks/ folder, no dist/ entry, no composer.json/package.json/node_modules/tests//.github

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.