ci: fetch the release tag with basic auth

GitHub's git endpoint rejects a bearer header; it takes the job token as the
password of x-access-token, as actions/checkout does. The release tag is also
resolved in the job environment.

.github/workflows/release.yml

@@ -18,13 +18,12 @@ on:
 permissions:
   contents: write
 
-env:
-  NODE_VERSION: v24.12.0
-  RELEASE_REF: ${{ inputs.tag || github.ref_name }}
-
 jobs:
   release:
     runs-on: ubuntu-latest
+    env:
+      NODE_VERSION: v24.12.0
+      RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref_name }}
     steps:
       - name: Check out the tag
         env:
@@ -32,7 +31,8 @@ jobs:
         run: |
           case "$RELEASE_REF" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $RELEASE_REF" >&2; exit 1 ;; esac
           git init -q .
-          git -c http.extraheader="AUTHORIZATION: bearer $GITHUB_TOKEN" fetch -q --depth 1 \
+          basic=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)
+          git -c http.extraheader="AUTHORIZATION: basic $basic" fetch -q --depth 1 \
             "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$RELEASE_REF:refs/tags/$RELEASE_REF"
           git checkout -q "refs/tags/$RELEASE_REF"
       - name: Install Node