release-watch: trigger docker/release via workflow_dispatch (no PAT needed)

A tag pushed with the built-in GITHUB_TOKEN does not trigger the on:push:tags
workflows (GitHub's recursion guard), so the watcher's auto-bump tag would land
but docker.yml/release.yml would never run and the image would silently never
republish.

workflow_dispatch is the documented exception GITHUB_TOKEN is allowed to trigger,
so after tagging, the watcher now explicitly runs docker.yml + release.yml against
the new tag ref (gh workflow run --ref v${new}). Both derive their version from
GITHUB_REF_NAME, so the dispatched build produces the identical X.Y.Z + latest
image tags a native tag-push would. Adds actions:write for the dispatch. No PAT
or extra secret required (GitHub provides no API to mint one anyway).

Author: MattJackson

.github/workflows/headroom-release-watch.yml

@@ -18,6 +18,7 @@ on:
 
 permissions:
   contents: write # commit the bump + push the tag
+  actions: write # `gh workflow run` the publish workflows (workflow_dispatch)
 
 env:
   UPSTREAM: headroomlabs-ai/headroom
@@ -79,5 +80,12 @@ jobs:
           the ml-feature gate. Built + tested green (lexical/no-ml). Republishing the hook image."
           git push origin HEAD:main
           git tag "v${new}" -m "headroom-hook v${new} — built on headroom ${LATEST}"
-          git push origin "v${new}"   # -> docker.yml + release.yml republish
+          git push origin "v${new}"
+          # A tag pushed with the built-in GITHUB_TOKEN does NOT trigger the `on: push: tags: v*`
+          # workflows (GitHub's recursion guard). workflow_dispatch is the documented EXCEPTION —
+          # GITHUB_TOKEN CAN trigger it — so kick docker.yml + release.yml explicitly against the new
+          # tag ref. Both derive their version from GITHUB_REF_NAME, so `--ref v${new}` yields the
+          # identical `X.Y.Z` + `latest` image tags a native tag-push would (no PAT/secret needed).
+          gh workflow run docker.yml  --ref "v${new}"
+          gh workflow run release.yml --ref "v${new}"
           echo "::notice::republished headroom-hook v${new} built on headroom ${LATEST}"