CI change. No API change. - Restored the GitHub Release on tag pushes. The move to `code-workflow` dropped the release step that `go-workflow` ran inline; a `release` job now calls the reusable `release-workflow` once the checks pass on a tag. - Removed the leftover `actions: read` grant, which the reusable `code-workflow` no longer requests.