ci(publish): manual dry run; GITFLOW: dry-run and green-before-tag gates

[michalharakal]

Two lessons from the 0.56.0 release, which tagged twice and failed its first publish in a runner setup step (#1293).

publish.yml: manual dry run

• New trigger workflow_dispatch. A manually started run executes the same pipeline — native matrix, Android SDK + NDK setup, signing validation, artifact staging — but ends in ./gradlew publishToMavenLocal on the runner.
• The dry-run step gets the signing secrets (so a bad key/password is caught) and is never given mavenCentralUsername/Password — it cannot upload.
• Publish to MavenCentral now carries if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/'), so only a tag push publishes.
• A summary step writes version / module / POM / signature counts to the job summary and fails if nothing, or nothing signed, was produced.

Why: this workflow was only ever exercised by the tag push itself, so ordinary CI could not reveal that it was broken.

GITFLOW.adoc: release process

• Dry-run gate: run the publish workflow by hand on the release branch before the release PR merges.
• Green-before-tag gate: after merging the release PR (merge commit), wait until every develop workflow on that merge commit has finished green, then tag.
• Tag target aligned with practice: the doc said "tag the release branch's own release: X.Y.Z commit"; 0.54.0 and 0.56.0 actually tag the release PR's merge commit on develop. The doc now says that, and the main fast-forward uses the same SHA.
• When a publish run fails: move the tag only if nothing was uploaded under the version (the workflow file that runs is the one at the tagged commit); otherwise the version is burned → patch release.

Verification

actionlint clean for the changed parts (one pre-existing shellcheck style note in an untouched step); YAML parses; GITFLOW.adoc renders with Asciidoctor. The dry run itself cannot be exercised from this PR — GitHub only offers workflow_dispatch for workflows whose trigger exists on the default branch. First real test after merge: gh workflow run publish.yml --ref develop.