feat: use gh api to push tags

[shavonn]

Description

Release tags are now created through the GitHub API instead of git tag + git push.

A git push of a tag whose commit touches .github/workflows/ is rejected for the
default GITHUB_TOKEN:

! [remote rejected] v0.1.0 -> v0.1.0 (refusing to allow a GitHub App to create or
update workflow .github/workflows/release.yml without workflows permission)

GITHUB_TOKEN authenticates as a GitHub App and cannot be granted the workflows
permission, so consumers were forced to supply a PAT with the workflow scope (and
wire it into actions/checkout's token:). Worse, the protection is inconsistent for
tag pushes — it can pass on one release and reject the next depending on whether the
tagged commit is seen as modifying a workflow file — which made it hard to diagnose.

Creating the tag via the API (gh api .../git/tags then .../git/refs) points a ref
at a commit that already exists on the server. There's no push and no workflow-file
push protection, so a plain GITHUB_TOKEN with contents: write is sufficient — no
PAT, no workflow scope — even in repos that contain .github/workflows/ files.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing usage to not work as expected)
• Refactor / internal change (no functional impact)
• Documentation update
• CI / tooling change

How Has This Been Tested?

Extracted the logic into a create_tag helper (scripts/tag.sh) and added
tests/tag.bats, which stubs gh (and git) on PATH to verify: both API
endpoints are hit; the tag object is built from the commit SHA/message/type; the ref
is pointed at the returned tag-object SHA (not the commit SHA); and git push is
never invoked. Ran the full suite and bash syntax checks locally.

• bats tests/ passes (81 tests: 4 new + 77 existing)
• Added or updated tests covering the change
• Manually exercised the change end-to-end in a fork (Phase 1 / Phase 2 / npm publish, as applicable)

Test Configuration:

• Runner OS: ubuntu-latest
• Node version (if npm publishing is involved): 24
• Inputs exercised: create-tag: true with the default GITHUB_TOKEN (no PAT), in a repo containing .github/workflows/

Checklist

• My code follows the style guidelines of this project (bash set -euo pipefail, quoted expansions)
• I have performed a self-review of my code
• I have added tests that prove my fix is effective or that my feature works
• New and existing tests pass locally with my changes
• I have updated the README and action.yml descriptions where relevant
• My commit messages follow Conventional Commits
• Any breaking changes (input renames, default changes, output changes) are clearly called out above