Make DRY_RUN configurable via UI input on release-package-registry-distribution pipeline

[teresaromero]

Context

Follow-up from review feedback on #1808 (#1808 (comment), by @mrodm), scoped out of that PR to keep it focused on the image rename.

.buildkite/release-package-registry-distribution.yml hard-codes DRY_RUN: false in the release-distribution step's env block (line 41). That value flows into .buildkite/scripts/publish-distribution.sh (lines 36-44), which decides whether docker buildx imagetools create actually pushes or runs with --dry-run, and into the "Trigger copy release images to Docker Hub" step, which reads DRY_RUN from meta-data to decide whether to trigger the DockerHub copy at all (lines 59-63).

Because it's hard-coded to false, there's currently no way to trigger this pipeline from the Buildkite UI in dry-run mode to validate a release without actually pushing/tagging images and copying them to DockerHub.

Proposed change

Per @mrodm's suggestion:

1. Add a DRY_RUN field to the existing UI input step (key: input, gated on build.source == 'ui'), with options "true"/"false" defaulting to "true".
2. Remove the hard-coded DRY_RUN: false from the release-distribution step's env block.
3. Update publish-distribution.sh to pull DRY_RUN from Buildkite meta-data (like DOCKER_TAG already does):

   DRY_RUN="$(buildkite-agent meta-data get DRY_RUN --default="${DRY_RUN:-"false"}")"

Expected behavior

• Triggered from another pipeline (e.g. fleet-server via trigger step) without setting DRY_RUN: defaults to false (real push) — unchanged automated-release behavior.
• Triggered manually from the Buildkite UI: DRY_RUN defaults to true, so UI runs are safe-by-default.

Files involved

• .buildkite/release-package-registry-distribution.yml
• .buildkite/scripts/publish-distribution.sh