Restrict self-hosted release workflow to trusted tags

[Lucenx9]

Motivation

• Prevent manual workflow_dispatch runs from executing repository-controlled code on self-hosted runners that have Docker access by ensuring the certified release matrix only runs for trusted release tags.
• Preserve the existing release verification flow that relies on tag-protected execution and avoid broadening the CI trust boundary to manually-selected refs.

Description

• Removed the workflow_dispatch trigger from .github/workflows/self-hosted-release.yml so the workflow is only triggered by push to tags matching self-hosted-v*.
• Tightened the certified-matrix job condition to if: startsWith(github.ref, 'refs/tags/self-hosted-v') so the matrix cannot run on workflow_dispatch or branch refs.
• Updated tests/contract/release/self-hosted-matrix.test.ts to assert that the workflow contains no workflow_dispatch entry and adjusted the test name accordingly.
• Committed the changes to enforce the regression via the repository's contract tests.

Testing

• pnpm exec prettier --check .github/workflows/self-hosted-release.yml tests/contract/release/self-hosted-matrix.test.ts — succeeded.
• pnpm vitest run tests/contract/release/self-hosted-matrix.test.ts — succeeded (contract test file passed).
• git diff --check — succeeded with no whitespace errors.

---

Codex Task