ci: select release-prep mode for hosted release-train readback #2526

Problem

The manual hosted release-train readback workflow always invokes the checker in planning mode. After a release-prep PR changes VERSION to the candidate target, the hosted readback rejects the valid candidate because planning mode expects the prior current version.

Scope

• make workflow_dispatch select planning or release-prep mode from VERSION and the release-train manifest;
• invoke tools/release_train_check.py --remote --release-prep when VERSION matches the target;
• retain planning mode for the pre-release baseline;
• add a workflow contract test.

Acceptance criteria

• the hosted readback can validate a merged release-prep candidate;
• the workflow fails clearly when VERSION matches neither manifest identity;
• existing credential and least-privilege behavior remains unchanged.

Refs #2524