Protect guarded release tags

[josephbirkner]

Summary

GitHub does not allow its built-in github-actions[bot] identity to bypass repository rulesets. This completes the guarded-release setup by making the release workflow's tag push use a dedicated write deploy key.

• use MAPGET_RELEASE_DEPLOY_KEY only while creating the validated release tag
• populate known_hosts from GitHub's authenticated metadata endpoint
• keep GitHub release creation and workflow dispatch on the scoped GITHUB_TOKEN
• document how the workflow-owned release-tag rule is enforced

The matching deploy key and encrypted Actions secret are configured in the repository. Once this is merged, the v*.*.* tag ruleset can be activated with deploy keys as its sole bypass actor.

Validation

• YAML parsing with PyYAML
• actionlint v1.7.12
• git diff --check

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Package	Line Rate	Branch Rate	Health
libs.geojsonsource.include.geojsonsource	100%	50%	✔
libs.geojsonsource.src	66%	38%	➖
libs.gridsource.include.gridsource	0%	0%	❌
libs.gridsource.src	0%	0%	❌
libs.http-datasource.src	48%	26%	❌
libs.http-service.src	58%	24%	➖
libs.location.include.mapget.location	100%	100%	✔
libs.location.src	83%	40%	✔
libs.logging.include.mapget	5%	2%	❌
libs.model.include.mapget.model	51%	30%	➖
libs.model.src	73%	42%	➖
libs.service.include.mapget.service	56%	50%	➖
libs.service.src	74%	38%	➖
Summary	65% (12147 / 18562)	35% (12923 / 37286)	➖

Minimum allowed line rate is 50%