fix(ci): install dune and build inside the opam env

First run failed with `dune: command not found`.

- ocaml/setup-ocaml provides a compiler and opam, not dune. dune is an
  ordinary opam package and this project has no .opam file for the
  action to infer one from, so nothing pulled it in
- add `opam install -y dune.3.14.0`, pinned to the version
  compiler/dune-project targets (`(lang dune 3.14)`)
- run the build as `opam exec -- ./scripts/mkdist.sh`: the script calls
  dune internally, so it needs the opam environment on PATH

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -37,12 +37,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # The compiler is OCaml stdlib only — no opam packages — so this
-      # step exists purely to get a compiler and dune onto the runner.
+      # setup-ocaml gives a compiler and opam. It does NOT give dune —
+      # dune is an ordinary opam package, and this project has no .opam
+      # file for it to infer one from, so nothing pulls it in. The first
+      # run failed here with `dune: command not found`.
       - uses: ocaml/setup-ocaml@v3
         with:
           ocaml-compiler: '4.14'
 
+      # Pinned to the version this project is developed against
+      # (compiler/dune-project says `(lang dune 3.14)`).
+      - name: Install dune
+        run: opam install -y dune.3.14.0
+
       # The tag is the release's identity; VERSION is what the binaries
       # report. If they disagree the download URL would name a version
       # nobody can install. mkdist.sh already guards VERSION against the
@@ -57,8 +64,10 @@ jobs:
             exit 1
           }
 
+      # `opam exec --` because mkdist.sh calls dune internally; without
+      # the opam environment on PATH the script cannot find it.
       - name: Build the tarball
-        run: ./scripts/mkdist.sh
+        run: opam exec -- ./scripts/mkdist.sh
 
       # The site links one exact filename. If mkdist ever changes its
       # naming, the download button 404s for every visitor — so fail