fix(ci): install syft in release.yml + add workflow_dispatch recovery (#121)

The v0.3.1 release run failed: goreleaser's `sboms:` step shells out to syft,
but release.yml installed only cosign — `exec: "syft": not found`. Builds,
archives, and checksums all succeeded; SBOM cataloging aborted the release
before artifacts/signature attached.

- Install syft via anchore/sbom-action/download-syft (pin reused from
  security.yml) before the goreleaser step.
- Add workflow_dispatch(tag) + checkout ref=${{ inputs.tag || github.ref }} so
  the fixed workflow can re-run against an already-pushed (immutable) tag;
  goreleaser `release: mode: append` attaches artifacts to the existing release
  without re-cutting the tag.

actionlint clean. After merge, dispatch with tag=v0.3.1 to recover its signed
artifacts.


Claude-Session: https://claude.ai/code/session_01LDQVJrixs2nJoea67a8pEG

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: aksOps

.github/workflows/release.yml

@@ -21,6 +21,15 @@ on:
   push:
     tags:
       - 'v*'
+  # Manual re-release: run the CURRENT (default-branch) workflow against an
+  # already-pushed tag. GoReleaser's `release: mode: append` adds artifacts to
+  # the existing release WITHOUT mutating the immutable tag — used to recover a
+  # release whose original tag-push run failed.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to (re)build + sign (e.g. v0.3.1)'
+        required: true
 
 # Workflow-level default: minimum needed for actions/checkout. The release job
 # escalates to contents: write (create/append the GitHub release + upload
@@ -46,7 +55,10 @@ jobs:
         # actions/checkout v4.2.2
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
-          # Full history so goreleaser's changelog/version detection works.
+          # On workflow_dispatch, build the supplied existing tag; on a tag
+          # push, the pushed ref. Full history so goreleaser version detection
+          # works.
+          ref: ${{ inputs.tag || github.ref }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -77,6 +89,13 @@ jobs:
         # signing step in .goreleaser.yaml (signs: cmd: cosign).
         uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159
 
+      - name: Install syft
+        # anchore/sbom-action v0.24.0 (download-syft sub-action) — puts `syft`
+        # on PATH for the goreleaser `sboms:` step, which shells out to syft per
+        # archive. Without this goreleaser fails: `exec: "syft": not found`.
+        # Pin reused from security.yml.
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610
+
       - name: Run GoReleaser
         # goreleaser/goreleaser-action v6.2.1
         uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3