fix(ci): fetch llama-server sidecar before lint in release publish job

[quiet-node]

Description

The v0.15.0 release-please publish run failed: binaries/llama-server-aarch64-apple-darwin doesn't exist. The build-and-release job ran Lint and format check (which compiles build.rs via cargo clippy) before the llama-server sidecar was present. Its Cache llama.cpp sidecar step only restored from cache (no fetch on miss) and sat after lint/test, so the first-ever release run hit a cache miss with no sidecar and exited 101. The same bug was already fixed in nightly-release.yml (#235) and is correct in pr-build-validation.yml; this job never got the patch because it had never run until the first real release.

As a result, the v0.15.0 GitHub release was created but published with no assets.

Key changes

• Move Cache llama.cpp sidecar ahead of lint/typecheck/test and add a Fetch llama-server sidecar step (bun run engine:ensure) so the sidecar exists before any cargo invocation. Mirrors nightly-release.yml and pr-build-validation.yml.
• Add a workflow_dispatch trigger (with a tag input) so the build/publish job can be re-run to attach assets to an existing release tag after a failed run. The build job now runs on dispatch and falls back to inputs.tag for the release tag; checkout uses the tag's source. This is the same resilience the nightly workflow already has.

Testing

CI-workflow-only change; no app code touched. YAML validated. The fix path is already proven green by the identical sidecar-fetch ordering in nightly-release.yml and pr-build-validation.yml.