feat: automate artifact creation on cli native release

[samrose]

Summary

• Fix CLI release artifacts not being created when -cli tags are pushed automatically by the AMI release workflow
• The root cause is that GitHub Actions does not allow workflows triggered by the default GITHUB_TOKEN to trigger other workflows via tag push events
• Add explicit gh workflow run cli-release.yml trigger in ami-release-nix.yml after creating the -cli tag, following the same pattern used for
  publish-nix-pgupgrade-scripts.yml
• Update cli-release.yml to support workflow_dispatch for the release job, with explicit tag_name resolution so artifacts attach to the correct -cli tag
• CLI tagging and release only happen on branch merges, not on workflow_dispatch of the AMI workflow (existing guard preserved)
• Older -cli tags can be backfilled by manually running cli-release.yml via workflow_dispatch