ci: trust mirror dispatch from main

[xxvcc]

Summary

• remove the tag-bound release event from the privileged mirror workflow
• require an explicit workflow dispatch whose ref and workflow SHA are bound to protected main
• document the release-time dispatch and default-branch-only environment policy

Validation

• go test -race ./...
• go vet -printf.funcs=printf,errorf,warnf ./...
• python3 -B -m unittest -v scripts/mirror_receiver_test.py
• shellcheck -S warning scripts/*.sh
• actionlint .github/workflows/*.yml
• static amd64/arm64 builds
• govulncheck v1.6.0 ./...
• recovery dispatch 30271357472 synced immutable v2.8.3 and passed the public mirror install canary