ci: apply the job split to release.yml #433

What

Give release.yml the same protection that version-bump.yml and docs.yml get from their job split: no job that holds a write token, or the identity token used for attestations, may install or run the project's dependencies.

Why

release.yml runs when a version tag is pushed. It builds, attests and publishes the release, and today it installs the project's dependencies in a job that has write permissions. A compromised dependency would then run next to those permissions at the next release.

Scope

• Split release.yml: dependency installation, builds and tests run in read-only jobs; the jobs that attest and publish run only pinned tools and check what they receive before they act.
• Verify that the archive that is attested and published is exactly the one that was built and checked.
• Accept only release tags made by the release process.
• Keep the real release flow working: past releases' tags must still validate.

Done when

• No job in release.yml both runs dependency code and holds a write or identity token.
• A real release still builds, attests and publishes.

Refs #418