trigger-docs.yml fired on release `published`, which GitHub sends for
pre-releases too. v1.9.0-rc.1 (run #38) and v1.9.0 published as a
pre-release (run #39) both dispatched update-cli-docs.yml in
temporalio/documentation; run #38 opened an unwanted docs PR.

Switch to `released`, which fires on a direct full-release publish and
on a pre-release-to-release promotion, but never for a pre-release.
Add a job-level gate that also rejects drafts and side-channel tags
(v1.8.3-server-1.32.0-162.0, v1.7.4-standalone-nexus-operations,
v1.6.3-serverless, and similar) built from feature branches, as
defense in depth behind the event-type change. workflow_dispatch stays
exempt so docs can still be backfilled on demand.

github.ref_name resolves to the selected branch on a manual dispatch,
not a tag: run #37 dispatched cli_release_tag=main to
temporalio/documentation. Add a required release_tag input for
workflow_dispatch, and source RELEASE_TAG from the release payload's
tag_name on the release event or from the new input on dispatch.

secrets.GITHUB_TOKEN and the get_user step outputs were interpolated
directly into run: blocks, unlike github.actor in the same file, which
already goes through env:. Route them the same way to avoid shell
injection from a value GitHub Actions doesn't sanitize before
substitution.

prerelease/draft/tag-shape don't rule out a hotfix to an older minor
line (patching v1.7.x after v1.8.0 is already GA, for example) — that's
a real full release, but generating docs from it would overwrite the
newer version's command reference.

The release payload has no "is latest" field (confirmed against the
live API: a release object exposes prerelease/draft/tag_name/etc., but
nothing about latest status), so compare the tag against
GET /releases/latest instead, in a step rather than the job-level `if:`
since expressions can't make API calls. workflow_dispatch stays exempt,
consistent with the existing gate: backfilling an older tag on purpose
is a deliberate choice, not something to second-guess.