Always enable workflow_dispatch for manual recovery

Always enable workflow_dispatch where operators need manual recovery. For privileged recovery, choose a no-secret relay protected by a main-only environment and a successful default-branch workflow_run handoff over direct secret-bearing dispatch, because a dispatcher selects workflow YAML before jobs, guards, or checkout run. Identify workflows by checked-in filename (for example, ci-poller.yml) rather than placeholders or numeric IDs.