ci(release): honor `tag` workflow_dispatch input in version preflight

On workflow_dispatch from a branch, GITHUB_REF_NAME is the branch name
(e.g. 'main'), so the preflight failed with 'Tag version (main) does
not match Cargo.toml version (X)' — which made the emergency
skip_reliability_gates=true bypass itself unusable.

Honor the explicit 'tag' workflow_dispatch input when present, falling
back to GITHUB_REF_NAME for tag-push events.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>