Harden release workflow shell inputs

[terjekv]

Summary

• pass the resolved release tag to check-release.sh through a step-scoped environment variable
• pass the verified release tag to publish-github-release.sh through a step-scoped environment variable
• record the release-workflow hardening in the Unreleased security changelog

Security impact

This addresses the two template-injection findings reproducible in .github/workflows/release.yml. GitHub expressions are no longer interpolated directly into generated shell source; the shell receives each value as data through RELEASE_TAG and retains the existing quoting.

Release behavior, permissions, trusted-publishing provenance, server compatibility, MSRV, dependencies, and public APIs are unchanged.

Verification

• zizmor 1.16.3 --offline .github/workflows/release.yml reports no template-injection findings
• ./scripts/test-release-provenance.sh
• ./scripts/test-github-release.sh
• cargo fmt --all -- --check
• git diff --check