ci(release): build the dispatched tag, not the dispatch ref

Without this a workflow_dispatch re-publish would have built main and
attached a binary whose --version did not match the release tag.

.forgejo/workflows/release.yml

@@ -31,6 +31,11 @@ jobs:
     steps:
       - name: Checkout
         uses: https://code.forgejo.org/actions/checkout@v4
+        with:
+          # A tag push builds that tag; a manual dispatch builds the tag the
+          # caller named (otherwise the binary version would not match the
+          # release it is attached to).
+          ref: ${{ github.event.inputs.tag || github.ref_name }}
 
       - name: Build ${{ env.TARGET }} in a rust container
         run: |