Fix/release untagged guard (#399)

* fix(release): prevent untagged fallback from tauri publish

Set explicit github-script output for release_id and validate it before build jobs.
This prevents tauri-action from creating untagged releases when release id wiring
breaks and keeps assets attached to the intended app-v tag release.

* fix(release): add source-only promote mode and harden release binding

Add a source_only dispatch option to promote workflows and propagate it into
channel publish so maintainers can skip platform builds and verify-nix when needed.
Also validate release/tag/commit binding to prevent untagged fallback and ensure
source archives stay aligned with the intended app-v tag.

.github/workflows/release.yml

@@ -1,7 +1,5 @@
 name: Release Channel
 
-# Same GITHUB_TOKEN push limitation as Next Channel (see next.yml).
-#
 # workflow_dispatch: use workflow from `main` for latest publish logic; checkout ref is always `release`.
 on:
   push:
@@ -11,13 +9,15 @@ on:
       - "flake.lock"
       - "nix/**"
   workflow_dispatch:
-  workflow_run:
-    workflows: ["Promote next to release"]
-    types: [completed]
+    inputs:
+      source_only:
+        description: "Create/refresh tagged release only (skip platform builds and verify-nix)"
+        required: false
+        default: false
+        type: boolean
 
 jobs:
   publish-release:
-    if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
     uses: ./.github/workflows/reusable-channel-publish.yml
     with:
       channel: release
@@ -25,5 +25,6 @@ jobs:
       target_branch: release
       prerelease: false
       draft_release: true
-      verify_nix: true
+      verify_nix: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') }}
+      build_platform_artifacts: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.source_only == 'true') }}
     secrets: inherit