fix(ci): pypi-publish workflow — add workflow_dispatch, pin artifacts, handle existing release

[nullhack]

Problem

pypi-publish.yml never triggered for v7.0.20260422 because the tag was already on the remote (created by gh release create manually) when tag-release.yml ran — so no push: tags: v* event was emitted.

Changes

• Add workflow_dispatch with tag input — allows manual re-runs for existing tags
• Fix release job: if a GitHub Release already exists for the tag, upload dist files to it (gh release upload --clobber) instead of failing on gh release create
• Pin download-artifact to SHA d3f86a106a0bac45b974a628896c90dbdf5c8093 (v4) — consistent with upload-artifact pin
• Checkout correct ref in both build and release jobs when triggered via workflow_dispatch