ci: fix release automation dispatch

[valiantone]

What

Fix release automation so future version bump merges do not depend on a tag push created by GITHUB_TOKEN to trigger a separate workflow.

Changes:

• Adds workflow_dispatch support to .github/workflows/release.yml with a required tag input.
• Checks out the requested release tag for manual dispatches and tag pushes.
• Upgrades astral-sh/setup-uv from v3 to v4 in the release workflow.
• Makes GitHub Release creation idempotent by skipping creation when the release already exists.
• Grants actions: write to auto-tag.yml and explicitly dispatches release.yml after creating a new tag.
• Updates README.md to explicitly list Python 3.11, 3.12, 3.13, and 3.14 support.
• Adds release-time package metadata verification: twine check plus an sdist PKG-INFO assertion that README.md is embedded as the PyPI long description.

Also completed the missing v0.1.5 GitHub Release manually from the existing tag: https://github.com/KnowGuard-AI/HotMem/releases/tag/v0.1.5

Why

PR #19 merged on May 28, 2026 and Auto Tag did run, but it found v0.1.5 already existed and skipped tag creation. Since no new tag was pushed, release.yml did not run. There is also a future reliability issue: workflows triggered by GITHUB_TOKEN-created events may be suppressed by GitHub, so chaining release publication only from the auto-created tag push is brittle.

The current PyPI v0.1.5 page was built from the older v0.1.5 side tag, so its metadata can look stale. PyPI does not allow replacing already-published distribution files for the same version. This PR ensures the next release builds from the checked-out release tag and fails before upload if README.md is not included as the package long description.

Verification

• YAML parsed successfully with Ruby YAML loader
• uv build completed locally
• Verified README.md is embedded in sdist PKG-INFO
• Confirmed v0.1.5 GitHub Release exists and is marked latest
• Tests pass: /Users/zubinj/forge/.knwb/bin/pytest -> 33 passed in 0.84s on Python 3.13.5
• Lint passes: /Users/zubinj/forge/.knwb/bin/ruff check src/ tests/ -> All checks passed
• Format check passes: /Users/zubinj/forge/.knwb/bin/ruff format --check src/ tests/ -> 18 files already formatted
• No new external dependencies added to core