The organisation allows only its own actions, so the release job failed at startup. Checkout uses git with the job token and Node comes from the official tarball verified against its SHA-256. A manual dispatch builds an existing tag, so a tag cut before this change is released without moving it.