fix: make bootstrapping a deliberate dispatch and list every asset released

Self-review of the two preceding commits.

- the release body hardcoded one FAA basename while files: uploads every source by glob, so
  each release attached an asset it did not list; basenames are now derived the same way
- allow_bootstrap was a standing matrix key on tc that nothing forced anyone to remove, so
  an outage longer than the release walk-back would have rebuilt from one day with a green
  run; it is now a workflow_dispatch input naming the one source permitted to bootstrap
- the per-source glob excluded prefixes by substring while build_registry.py matches the
  source token exactly, so a future source named registry_* would have been dropped here
  and kept there; both now anchor on the same filename shape
- README lists the Transport Canada asset, which the previous commit began publishing

Generated-by: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -36,6 +36,11 @@ df
   All [FAA registration data](https://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/releasable_aircraft_download) from 2023-08-16 to present (~275 MB).
   Superseded by `openairframes_registry.csv`; still published so existing consumers keep working.
 
+- **openairframes_tc.csv**  
+  The [Transport Canada Civil Aircraft Register](https://wwwapps.tc.gc.ca/saf-sec-sur/2/ccarcs-riacc/RchSimp.aspx),
+  ~35k aircraft with full ICAO 24-bit hex coverage. Also folded into
+  `openairframes_registry.csv`; published separately for the same reason as the FAA CSV.
+
 - **ReleasableAircraft_{date}.zip**  
   A daily snapshot of the FAA database, which updates at **05:30 UTC**