Add create_release_tag.yml workflow for pupmod repos

[silug]

What this does

Adds a new puppetsync-managed GitHub Actions workflow, create_release_tag.yml, for all pupmod repos, replacing the local shell script currently used to tag module releases.

It is a workflow_dispatch action that:

• Must be dispatched from the repository's default branch (asserted)
• Reads the release version from metadata.json and validates it: SemVer format, tag doesn't already exist, rake pkg:check_version, rake pkg:compare_latest_tag, and rake metadata_lint — all before tagging (today these only run in tag_deploy.yml, after the tag is already pushed)
• Generates the tag annotation from the CHANGELOG via rake pkg:create_tag_changelog (same as the local script)
• Creates the annotated tag and pushes it, triggering the existing tag_deploy.yml release pipeline
• Supports a dry_run input that validates everything and prints the would-be annotation without pushing

Notes

• Token: the checkout/push uses SIMP_AUTO_GITHUB_TOKEN__REPO_SCOPE (the same org PAT tag_deploy.yml already uses to dispatch release_rpms.yml), because tags pushed with the default GITHUB_TOKEN do not trigger other workflows. It falls back to GITHUB_TOKEN (documented in the header), which still creates the tag but won't fire tag_deploy.yml.
• Verified there are no rulesets or tag protections on the pupmod repos and the org's default workflow permissions are write, so the push itself is unobstructed; the job also declares permissions: contents: write explicitly.
• Conventions match the currently-deployed workflows (actions/checkout@v7, ruby/setup-ruby@v1 with Ruby 3.4.9, PUPPET_VERSION: '~> 8') rather than the older pinning still present in some templates here, so Renovate can manage the versions per-repo after sync.
• Improvements over the local script: no root-owned vendor/+Gemfile.lock litter in the working tree, an enforced local-matches-origin default branch (it tags what's actually on GitHub), pre-tag RELENG validation, and a dry-run mode replacing the 5-second Ctrl-C window.
• pupmod project type only; the rubygem repos use different tooling and could get an equivalent later if this works out.

🤖 Generated with Claude Code