CD: extract release verification into reusable workflow

Move verify-release checks into a standalone workflow that can be
triggered manually (workflow_dispatch) or called from the CD pipeline
(workflow_call). This allows re-running verification against any
release without a new tag push.