ci(release): create release tags with a deploy key

[jo16oh]

The next release fails at "Create tag". The tags ruleset blocks tag creation for GITHUB_TOKEN, and adding GitHub Actions as a bypass actor fails on a personal repository with:

422 Actor GitHub Actions integration must be part of the ruleset source or owner organization

• Push the tag over SSH with a deploy key, the ruleset's only bypass actor
• Keep the key as RELEASE_TAG_KEY in the release environment, limited to main
• Load the key into an ssh-agent that ends with the step, so it is never written to disk
• Run the whole release job in that environment. If npm's trusted publisher names an environment, it must be release

The deploy key, the environment and the ruleset bypass are already set up. The SSH push has not run yet; the first release tests it.