Refresh TagBot workflow

[galjos]

Summary

• Update TagBot from v1.18.1 to v1.25.7.
• Remove the unusable SSH deploy-key input because this repository has no deploy keys configured.
• Trim TagBot permissions to the writes/reads it needs.
• Remove the stale CI push trigger for the deleted develop branch.

Validation

• YAML parsed with Ruby YAML.load_file for TagBot and CI workflows.
• git diff --check

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.22%. Comparing base (0b5c4e6) to head (6a03d51).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #28   +/-   ##
=======================================
  Coverage   98.22%   98.22%           
=======================================
  Files           8        8           
  Lines         282      282           
=======================================
  Hits          277      277           
  Misses          5        5           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.