ci-poller-dispatch.yml manual recovery

Always retain .github/workflows/ci-poller-dispatch.yml for manual recovery. Chose a no-secret workflow_dispatch relay in environment: production, restricted to main, followed by the default-branch workflow_run poller over direct privileged dispatch because GitHub loads YAML from the caller-selected ref before checkout. The relay must declare permissions: {}, reference no repository secrets, and the poller must accept it only after a successful main relay run. Keep validated repository_dispatch self-dispatch separate from manual recovery.