fix(release): trigger release-cli via KIT_RELEASE_TOKEN tag push + manual dispatch

[BCook98]

The changesets publish step pushes the `vX.Y.Z` tag with `GITHUB_TOKEN`, but the fallback secret was `RELEASE_PAT` — a tag pushed with the default `GITHUB_TOKEN` (or a non-PAT) does not trigger tag-listening workflows, so `release-cli.yml` never fired. This wires the real PAT and makes the CLI release re-runnable by hand.

• release.yml: token fallback `RELEASE_PAT` -> `KIT_RELEASE_TOKEN` (a real PAT push triggers the tag workflow).
• release-cli.yml: add `workflow_dispatch` (input `tag`); checkout uses `ref: ${{ github.event.inputs.tag || github.ref_name }}` so a manual run builds the chosen tag; the `notify-consumers` dispatch sends `${{ github.event.inputs.tag || github.ref_name }}` so the dispatched version is the TAG, not a branch, on manual runs.

actionlint: clean on both files.