Fix release tag workflow permissions and checkout auth

[Copilot]

The release tagging workflow is still failing after the earlier token-auth update. Tag creation now hits GitHub permission/auth issues when the workflow tries to push the generated tag.

• Tag job permissions

  • Add contents: write to the tag-release job in both branch deployment workflows so the reusable tagging workflow can push release tags.

• Reusable tag workflow auth

  • Disable persisted checkout credentials in step-tag-release.yml.
  • This avoids actions/checkout leaving conflicting git credentials behind and lets the explicit automation token drive git push.

• Changelog

  • Record the workflow fix under CHANGELOG.md [Unreleased].

tag-release:
  permissions:
    contents: write
  uses: ./.github/workflows/step-tag-release.yml

- uses: actions/checkout@...
  with:
    token: ${{ secrets.github-token }}
    persist-credentials: false

[github-actions]

Test Results

201 tests  ±0   201 ✅ ±0   1s ⏱️ -1s
  1 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit cf17945. ± Comparison against base commit c893e81.