ci: add a dispatchable release and keep the README version in sync (#7)

Two independent failures broke the 0.2.0 release.

The publish job died in hevi with "422 Invalid target_commitish parameter":
chart-releaser posts an empty target_commitish unless --commit is passed, which
hevi never did (tada5hi/hevi#60, fixed by tada5hi/hevi#61). Publishing was only
reachable from a master push, so there was no way to retry it once the version
bump had already been merged. The release workflow now also accepts a
workflow_dispatch, with release-please skipped on that path, and a concurrency
group so a manual run cannot race a push.

The lint job died on helm-docs drift: release-please bumps Chart.yaml but not
the generated README, whose badge still advertised 0.1.0. The README is now a
release-please extra-file. Its generic updater rewrites only the first semver on
an annotated line, so the version badge is hand-rolled to carry the version
exactly once and to terminate it with "?" instead of the "-informational" color
segment, which the updater would otherwise swallow as a prerelease suffix.

chore(authup): pin release-please bootstrap and clarify encryption-ke…

…y docs

The bootstrap-sha marks the initial commit as pre-release history so
release-please does not propose a bump for it; chart-releaser publishes the
current 0.1.0 from Chart.yaml directly.