sec(ci): v* tag pushes are unrestricted and trigger the cudly-mcp release/publish pipeline unapproved #9

Summary

.github/workflows/release.yml (LeanerCloud/cloud-commitments-cli#1893) is this repo's first workflow triggered by a v* tag push, and its goreleaser, mcpb, and publish-registry jobs hold contents: write / id-token: write. CodeRabbit flagged (correctly) that nothing currently restricts who can trigger this pipeline: the repo has no tag-protection ruleset, so any collaborator with push access can create/push a v* tag and cause a real GitHub Release plus an mcp-publisher publish to the public MCP Registry under this org's OIDC identity.

This is the tag-level half of the same class of gap LeanerCloud/cloud-commitments-cli#1660 tracks for deployment environments. LeanerCloud/cloud-commitments-cli#1893 adds environment: release bindings to the three privileged jobs as the code-side half of the mitigation, matching this repo's existing (documented, honest) pattern in cleanup-staging.yml -- but per LeanerCloud/cloud-commitments-cli#1660's own finding, an environment: binding provides no real reviewer gate until protection rules are configured out-of-band, and GitHub auto-creates a referenced environment bare (no reviewers, no branch policy) on first use. Configuring that is a repo-admin action, not something a workflow-file PR can do.

What's needed (both are repo-admin / out-of-band actions)

1. Configure required reviewers on the release environment (Settings -> Environments -> release -> Required reviewers). Falls under LeanerCloud/cloud-commitments-cli#1660's general remit but calling it out here since release is a new environment feat(mcp): add GoReleaser + release workflow + MCPB bundle for cudly-mcp cloud-commitments-cli#1893 introduces.
2. Add a tag-protection ruleset restricting creation/update of refs matching v* to release maintainers (Settings -> Rules -> Rulesets, target "tag", pattern v*). The repo currently has only protect-default-branch (target: branch) -- no tag ruleset exists at all.

Until both are configured, pushing a v* tag runs the full release/publish pipeline unapproved -- same shape as LeanerCloud/cloud-commitments-cli#1660's finding, just for tags instead of environments.

Why not block LeanerCloud/cloud-commitments-cli#1893 on this

The workflow is genuinely inert until a maintainer manually creates and pushes a v* tag (out of scope for LeanerCloud/cloud-commitments-cli#1893 itself, which is machinery-only). The environment binding is landing now as the cheap code-side half; this issue tracks the two admin-side actions that make it a real gate.