release pipeline refactor

[wagoodman]

quick pass cleaning up the release pipeline:

• release.yaml: swapped DEPLOY_KEY for TAG_TOKEN in the ci-release step (for pushing tags; doesn't inherit workflow permissions), and updated the related env/permission comments
• added a skip-checks workflow_dispatch boolean input and wired check-gate to be skippable via if: ${{ !inputs.skip-checks }}
• added contents: read to the check-gate job permissions (only had checks: read)
• gave the release job an always() conditional so it still runs when check-gate is skipped, but only when version-available succeeded and check-gate didn't fail/cancel
• bumped go-make in .make to v0.7.0 (from v0.4.0)

notes: dependabot already has no grouping config and already lists /.make, and zizmor is already rules: {}, so nothing to do there. no golangci config in this repo. no separate manual tag/push step — ci-release handles tagging via go-make.