publication prep: gitleaksignore for synthetic test fixtures; releases go manual

ADR-0002 public flip (infra#20): the three gitleaks history findings are
synthetic test fixtures (credential-detector + crypto tests) — ignored
by fingerprint. release.yml moves from tag-trigger to workflow_dispatch:
svu now auto-cuts tags on every release-worthy push, and implicit PyPI
publishes on each bump are not wanted — releases stay deliberate.
Dead ci.yml.disabled dropped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -1,8 +1,7 @@
 name: Release
 
 on:
-  push:
-    tags: ["v*"]
+  workflow_dispatch: {}
 
 jobs:
   docker: