Revert "Pass GH token to release tag workflow"

[dceoy]

Reverts #98

[opencode-agent]

OpenCode PR Review: 1 inline finding(s).

[opencode-agent]

important · test-coverage-reviewer

Removing the GH_TOKEN secret passthrough from the tag job leaves the authentication contract with the remote github-major-version-tag.yml reusable workflow unvalidated. No test, actionlint rule, or CI dry-run checks that the called workflow can still create or update the major-version tag after this revert. Because the reusable workflow is referenced across repositories at the floating @main ref, actionlint cannot statically verify its required secrets, and the existing bats tests cover shell helpers rather than workflow contracts. If the called workflow still requires GH_TOKEN, the next release will fail to update the floating major-version tag (e.g., v1) without surfacing the problem until release time. Add a contract test that resolves the reusable workflow definition and validates the tag job's secrets/permissions, or include a dry-run/smoke step for the post-release workflow in CI.

[opencode-agent]

Review submitted: OpenCode PR Review on #100

Summary: 1 inline finding from test-coverage-reviewer. The other core reviewers (code-reviewer, performance-reviewer, documentation-accuracy-reviewer, security-code-reviewer) found no issues.

The retained finding flags that reverting the GH_TOKEN passthrough to the cross-repo reusable workflow leaves the authentication contract unvalidated by tests or CI dry-runs, which could delay detecting a release failure until the next release.

opencode session  |  github run