Make the workflow_dispatch publish path actually publish

[ChrisonSimtian]

The workflow_dispatch path on publish-packages-release.yml could never publish anything. It is the documented way to publish to nuget.org and the documented way to retry a partial publish — both silently did nothing while the run reported success.

Found while publishing v10.4.0-rc.4: run 30202826208 shows test + pack: success with all three publish jobs skipped, and a green overall conclusion.

Two independent causes

1. Skip propagation. validate-ref is skipped by design on workflow_dispatch (if: github.event_name == 'push'), and a skipped job propagates through the dependency graph. test-and-pack survives with always() — but that rescues only itself; its dependents still saw a skipped ancestor. This is why publish-github-packages and publish-github-releases skipped despite carrying no condition at all, which is the part that makes the failure so quiet.

2. The boolean compare. The opt-in was inputs.publish-to-nugetorg == true. A type: boolean input is only a real boolean when the run starts from the Actions UI; the REST API can only send strings, and gh workflow run rejects a JSON boolean outright (cannot unmarshal bool into Go value of type string). Comparing a string to a boolean casts both to numbers — 'true' → NaN, true → 1 — so the opt-in never matched from the CLI, including the exact invocation in docs/branching-and-release.md.

Fix

All three publish jobs gate on always() && needs.test-and-pack.result == 'success', and the opt-in accepts the string as well as the boolean.

Tag-push behaviour is unchanged: validate-ref still gates it, and nuget.org still requires both the flag and the nuget-org environment approval. This also makes the runbook's "re-running a publish job is idempotent" claim true for the first time.

Verification

Merging this and re-dispatching for v10.4.0-rc.4 is the test — publish → nuget.org should reach the approval gate instead of skipping. No code change, so Test/Pack are unaffected.