ci: trigger release via workflow_dispatch to fix GITHUB_TOKEN limitation

GITHUB_TOKEN push events don't trigger downstream workflows. Instead of
relying on tag push to trigger release.yml, sync-electron now explicitly
calls `gh workflow run` with the tag name after pushing.

- release.yml: accept `inputs.tag` for workflow_dispatch, checkout + release by tag
- sync-electron.yml: add `gh workflow run release.yml` step after tag push
- Add `actions: write` permission for workflow dispatch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -5,6 +5,11 @@ on:
     tags:
       - "v*"
   workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to release (e.g. v1.0.11)"
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -30,6 +35,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -72,11 +79,14 @@ jobs:
   release:
     needs: build
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/v') || inputs.tag
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+          fetch-depth: 0
 
       - name: Download all artifacts
         uses: actions/download-artifact@v4
@@ -84,14 +94,21 @@ jobs:
           path: artifacts
           merge-multiple: true
 
+      - name: Resolve tag
+        id: tag
+        run: |
+          TAG="${{ inputs.tag || github.ref_name }}"
+          echo "name=$TAG" >> "$GITHUB_OUTPUT"
+
       - name: Generate release notes
         id: notes
         run: |
-          PREV_TAG=$(git tag --sort=-v:refname | grep '^v' | sed -n '2p')
+          TAG="${{ steps.tag.outputs.name }}"
+          PREV_TAG=$(git tag --sort=-v:refname | grep '^v' | grep -v "^${TAG}$" | head -1)
           if [ -z "$PREV_TAG" ]; then
             BODY="Initial release"
           else
-            BODY=$(git log "${PREV_TAG}..HEAD" --no-merges --pretty=format:"%s" \
+            BODY=$(git log "${PREV_TAG}..${TAG}" --no-merges --pretty=format:"%s" \
               | grep -vE "^(chore|docs|ci)(\(.*\))?:" \
               | sed 's/^/- /')
             if [ -z "$BODY" ]; then
@@ -107,6 +124,7 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
+          tag_name: ${{ steps.tag.outputs.name }}
           body: ${{ steps.notes.outputs.NOTES }}
           draft: false
           prerelease: false

.github/workflows/sync-electron.yml

@@ -10,6 +10,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: write
   contents: write
   issues: write
 
@@ -93,6 +94,12 @@ jobs:
             git push origin electron
           fi
 
+      - name: Trigger release workflow
+        if: env.BUMP == 'true'
+        run: gh workflow run release.yml -f tag="$NEW_TAG" --ref electron
+        env:
+          GH_TOKEN: ${{ github.token }}
+
       - name: Create issue on conflict
         if: env.CONFLICT == 'true'
         run: |