release: SHA-pin actions/checkout in the deploy-key jobs

The checkout steps now hold the ruleset-bypass deploy key, so resolve actions/checkout by full SHA (v6.0.2, same pin as sync-base-action.yml) rather than the mutable v6 tag.

.github/workflows/release.yml

@@ -32,9 +32,16 @@ jobs:
       next_version: ${{ steps.next_version.outputs.next_version }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        # SHA-pinned (same pin as sync-base-action.yml): this step is handed
+        # the ruleset-bypass deploy key, so it must not resolve a mutable tag.
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          # Tag pushes below authenticate as the release deploy key (a
+          # bypass actor on the "Protect release tags" ruleset) instead of
+          # GITHUB_TOKEN, which can never bypass a ruleset. The key lives
+          # only in the main-restricted `production` environment.
+          ssh-key: ${{ secrets.RELEASE_TAG_DEPLOY_KEY }}
 
       - name: Get latest tag
         id: get_latest_tag
@@ -105,9 +112,16 @@ jobs:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        # SHA-pinned (same pin as sync-base-action.yml): this step is handed
+        # the ruleset-bypass deploy key, so it must not resolve a mutable tag.
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          # Tag pushes below authenticate as the release deploy key (a
+          # bypass actor on the "Protect release tags" ruleset) instead of
+          # GITHUB_TOKEN, which can never bypass a ruleset. The key lives
+          # only in the main-restricted `production` environment.
+          ssh-key: ${{ secrets.RELEASE_TAG_DEPLOY_KEY }}
 
       - name: Update major version tag
         run: |