Move release plan checks to a separate workflow (#17422)

We get a bunch of redundant skipped `Release / Build binary ...` jobs in
CI otherwise, and I would rather the release workflow didn't have a pull
request trigger at all.

Follows #17388

.github/workflows/check-release.yml

@@ -0,0 +1,24 @@
+on:
+  workflow_call:
+
+jobs:
+  dist-plan:
+    name: "dist plan"
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Install dist
+        shell: bash
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.30.2/cargo-dist-installer.sh | sh"
+
+      - name: Run dist plan
+        run: |
+          dist plan --output-format=json > plan-dist-manifest.json
+          echo "dist plan completed successfully"
+          cat plan-dist-manifest.json

.github/workflows/ci.yml

@@ -130,6 +130,11 @@ jobs:
     if: ${{ needs.plan.outputs.test-code == 'true' }}
     uses: ./.github/workflows/check-publish.yml
 
+  check-release:
+    needs: plan
+    if: ${{ needs.plan.outputs.run-checks == 'true' }}
+    uses: ./.github/workflows/check-release.yml
+
   check-generated-files:
     needs: plan
     if: ${{ needs.plan.outputs.test-code == 'true' }}

.github/workflows/release.yml

@@ -39,7 +39,6 @@ permissions:
 # If there's a prerelease-style suffix to the version, then the release(s)
 # will be marked as a prerelease.
 on:
-  pull_request:
   workflow_dispatch:
     inputs:
       tag: