ci(release): gate the tag on the pull request CI instead of re-running checks #59

The Release Gate workflow re-runs tests, lint and audit on the tagged commit. For this repo a pushed v* tag is already public when the gate runs, so a failure there only produces a red release badge, but it can fail on checks the pull request never ran (guard-core-rs 4.4.0 did, on a different toolchain).

I want the gate to check the same thing the pull request did. Proposed change to .github/workflows/release.yml:

• Resolve the tag from the v* tag push or from a new required tag input on workflow_dispatch, validate it against ^v[0-9]+\.[0-9]+\.[0-9]+$, and check out refs/tags/<tag>.
• Replace the test, lint and audit jobs with a check that the newest push run of each gating workflow (ci.yml) on the tagged commit concluded success, waiting up to an hour.
• The Module tag consumable job stays as its own job (it needs the tag to exist), and it now uses the resolved tag. govulncheck is dropped from the tag run because it is already a job of ci.yml on the same commit and dependency set.
• Every use of GITHUB_REF_NAME becomes the resolved tag, so a manual run from the default branch re-checks an existing tag.
• Nothing the old workflow ran at tag time is missing from pull request CI: Every command the old workflow ran (gofmt, go vet, go test, go test -tags integration, govulncheck, Go 1.26.x) already runs in ci.yml on pull requests.

Docs that describe the old release flow are updated in the same pull request.