ci(release): add workflow_dispatch + pre-build docker diagnostics

Adds a manual-trigger hook so we don't need a fresh commit to re-run
this pipeline, and dumps docker/buildx state before the build so CI
failures are diagnosable without docker.sock guesswork.

.forgejo/workflows/release.yml

@@ -4,13 +4,13 @@ name: release
 #
 #   push to main         → :main
 #   push tag vX.Y.Z      → :vX.Y.Z and :latest
-#
-# No-ops cleanly until the server skeleton (go.mod + Dockerfile) lands.
+#   workflow_dispatch    → manual trigger (same rules based on the ref)
 
 on:
   push:
     branches: [main]
     tags: ['v*']
+  workflow_dispatch:
 
 jobs:
   release:
@@ -34,6 +34,21 @@ jobs:
             echo "::notice::No Dockerfile + go.mod yet — release build skipped"
           fi
 
+      - name: Docker environment diagnostics
+        if: steps.guard.outputs.ready == 'true'
+        shell: bash
+        run: |
+          echo "--- whoami + env ---"
+          id
+          echo "DOCKER_HOST=${DOCKER_HOST:-<unset>}"
+          ls -la /var/run/docker.sock || echo "NO socket at /var/run/docker.sock"
+          echo "--- docker info ---"
+          docker version || true
+          docker info || true
+          echo "--- buildx ---"
+          docker buildx version || true
+          docker buildx ls || true
+
       - name: Compute image tags
         id: tags
         if: steps.guard.outputs.ready == 'true'