* release: push tags with the release deploy key
So the tag ruleset (terraform-config#81310) can be enforced: GITHUB_TOKEN can never bypass a ruleset, a deploy key can. No change to how releases are cut.
* release: SHA-pin actions/checkout in the deploy-key jobs
The checkout steps now hold the ruleset-bypass deploy key, so resolve actions/checkout by full SHA (v6.0.2, same pin as sync-base-action.yml) rather than the mutable v6 tag.
