feat(repos): let the factory's release deploy key create its release tags

[NWarila]

The factory's CI will create each container's release tag after a release-please merge. GitHub does not accept its built-in Actions app as a ruleset bypass actor (the apply of #100 failed with 422, reverted in #101), so CI pushes release tags over SSH with a write deploy key instead.

This change does two things in terraform/public/workflow-container-factory.yml:

• Version Tag Authority keeps admins as a bypass actor and adds DeployKey, so only admins and the repository's deploy key can create or update a <name>/v* tag. Release Tag Protection still keeps deleting or force-moving a tag to admins.
• A new release environment that only main may use. Its secret RELEASE_TAG_DEPLOY_KEY (the deploy key's private half) and the deploy key itself are created outside Terraform, which cannot hold key material; the comment in the file says so.

A tag push runs the workflow files at the tagged commit, so limiting who can create release tags is what keeps the factory's signing identity (build.yaml@refs/tags/<name>/v<version>) trustworthy. The bypass was tested first on a disposable repository: the deploy key is refused without the bypass and accepted with it, a workflow-token push is refused with this exact bypass list, and a tag pushed with a deploy key starts tag-push workflows.