Publish workflow: release environment and manual dispatch

[cfluke-cb]

Summary

• Run the publish job in the release GitHub environment so Maven Central and GPG secrets are read from environment-scoped secrets.
• Add workflow_dispatch with a required tag input so publish can be triggered manually (for example to retry a failed release).
• Update DEPLOY.md to document the release environment and manual run path.

Test plan

• Confirm the release environment exists in repo settings and required secrets are configured there.
• Merge and verify Actions → publish → Run workflow appears with the tag input.
• Optionally run a dry-run tag on a test release or manual dispatch to confirm checkout and version alignment.

Made with Cursor

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1