Fix release tag pushes to use the automation token explicitly

[Copilot]

The release tagging workflow is still failing after the earlier token-plumbing change: the reusable tag job receives the automation token, but the final git push is not consistently using it and is rejected with 403. This PR makes the tag push authenticate explicitly with the provided token inside the reusable workflow.

• Tag push authentication

  • Export GH_TOKEN from the reusable workflow secret.
  • Run gh auth setup-git before creating and pushing the tag so Git uses the intended automation credential for the remote.

• Reusable workflow behaviour

  • Keep the existing github-token secret contract in step-tag-release.yml.
  • Leave the branch workflow callers unchanged; they continue to pass CREATE_PR_TOKEN into the reusable tag job.

• Release notes

  • Update the unreleased changelog entry to describe the authentication change more precisely.

- name: Create tag
  env:
    GH_TOKEN: ${{ secrets.github-token }}
    VERSION: ${{ inputs.version }}
  run: |
    gh auth setup-git
    git tag -a "$VERSION" -m "Version $VERSION created via GitHub Actions"
    git push origin "$VERSION"

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• github-production-user-asset-6210df.s3.amazonaws.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-actions]

Test Results

201 tests  ±0   201 ✅ ±0   1s ⏱️ ±0s
  1 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit 249a745. ± Comparison against base commit 7ad006c.