GitHub's git endpoint rejects a bearer header; it takes the job token as the
password of x-access-token, as actions/checkout does. The release tag is also
resolved in the job environment.
The organisation allows only its own actions, so the release job failed at
startup. Checkout uses git with the job token and Node comes from the official
tarball verified against its SHA-256. A manual dispatch builds an existing tag,
so a tag cut before this change is released without moving it.
The signed distribution is published as a GitHub release by the release
workflow on v* tags, replacing the Gitea release and its Drone pipeline.
The release body and the dist README take the homepage from META.json.
marc
