fix(require-signed-release): plain-text the ref-name example so the action loads

An input's description embedded a live ${{ github.ref_name }} as an example.
GitHub evaluates ${{ }} expressions when it loads an action, and the github context is unavailable in that scope, so the whole action failed to load — a consumer's go-live and attest jobs died at "Set up job", before any step ran, on the first release to reference it.
Drop the ${{ }} wrapper; the ref name stays as plain-text documentation.

Author: gronke

.github/actions/require-signed-release/action.yml

@@ -29,7 +29,7 @@ inputs:
     default: ""
   attestation-tag:
     description: >-
-      A pushed companion (e.g. `${{ github.ref_name }}` on a `v*-sig` trigger)
+      A pushed companion (e.g. `github.ref_name` on a `v*-sig` trigger)
       whose release is derived from it: the tag it seals is looked up by
       commit, and the published release on that same commit is the one gated.
       Which suffix or prefix a repository attests with stays its own business,

CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project are documented in this file.
 The format follows [Keep a Changelog](https://keepachangelog.com); releases are cut from the `[Unreleased]` section by this repository's own `changelog` action — the flow dogfoods itself.
 
+## [Unreleased]
+
+### Fixed
+
+- `require-signed-release` loads again when used as a `uses:` action. An input's description embedded a live `${{ }}` expression as an example, which GitHub evaluates while loading the action — and the `github` context is unavailable there, so the action failed to load and every job referencing it died at "Set up job". The example is now plain text. It surfaced on the first go-live to reference the action.
+
 ## [1.6.0] - 2026-08-22
 
 ### Added