Migrate release workflow tag based

[spezzirriemiliano]

Migrate release deploy trigger from release/** branch push to manual tag-based dispatch

Replaces the branch-based production release trigger (push to release/**) with a manual, tag-based one. Production deploys are no longer triggered automatically by any push — instead, an operator runs the workflow manually from the Actions UI ("Run workflow") against
a semver tag (e.g. v1.2.3), which a new validate-tag job verifies before the pipeline proceeds.

Changes:

• Removed 'release/**' from the push trigger; added workflow_dispatch
• Added validate-tag job — validates the dispatched ref is strict semver (vX.Y.Z[-suffix]) before test-portal-generator runs
• deploy-to-production now gates on refs/tags/ instead of refs/heads/release/
• notify-on-failure updated to cover tag-based runs and the new validate-tag job (so an invalid-tag dispatch still notifies Slack)