Add tag-driven release via workflow_dispatch

[quantum-x]

Summary

Lets the Build iCopy-X IPK workflow create a GitHub release from a tag chosen at dispatch time, in addition to the existing push: tags: v* trigger. Previously the release job only fired when a v* tag was pushed, so a manual run against a branch (or a merged PR) built artifacts but never published a release.

What changed

• New release_tag workflow_dispatch input. Run the workflow from any branch and type a tag (e.g. v1.1.2). The build jobs check out that tag's code, ICOPYX_VERSION is stamped from it, and a release is published under it. Leave the field empty for the old build-only behavior.
• New ensure-tag job. If the given tag doesn't exist, it's created at the HEAD commit of the branch you dispatched from (github.sha), then the build/release run from it. If the tag already exists it's used as-is (never moved). Created with GITHUB_TOKEN, so it does not re-trigger the on: push: tags build (no double run). The job has no if so it always runs and no-ops on empty input — this avoids a skipped needs job cascading a skip to downstream jobs.
• PM3 version in the release body. Bound the clients table's PM3 version to resolve-pm3-tag's output instead of an undefined env, so it shows the actual PM3 release pulled during the build (it rendered blank on v1.1.1).

Behavior matrix

Trigger	Result
Push v* tag	Release built from the tag (unchanged)
Dispatch, release_tag empty	Build-only, no release (unchanged)
Dispatch, release_tag = existing tag	Build from that tag, publish release
Dispatch, release_tag = new tag	Tag created on selected branch's HEAD, then build + release

Notes

• Existing v* tag-push releases are unaffected.
• ensure-tag and release both use permissions: contents: write (same grant the release job already relied on to publish v1.1.1).

Follow-up to #5.