release pipeline refactor

[wagoodman]

quick pass refactoring go-struct-converter's release pipeline:

• release.yaml: swapped DEPLOY_KEY for TAG_TOKEN in the ci-release step (for pushing tags; doesn't inherit workflow permissions)
• release.yaml: added a skip-checks workflow_dispatch input and wired check-gate to be skippable (if: !inputs.skip-checks)
• release.yaml: added contents: read to check-gate permissions (only checks: read was present)
• release.yaml: added the always()-based if on the release job so it runs when check-gate is skipped but still requires version-available success
• bumped go-make to v0.7.0 in .make
• dropped dependabot grouping (go-minor-patch / actions-minor-patch) so updates come as individual PRs, plus the stale grouping comment block
• zizmor: removed the unpinned-uses config, leaving rules: {}
• golangci: swapped goimports for the native gci formatter (gofmt + gci with anchore prefix)

notes: no separate manual tag/push step existed (ci-release already does the tagging). .make was already listed in dependabot directories. make format produced no Go source reordering.