Require manual confirmation after OreSpawn release tags

[SkyBlade1978]

Summary

• stop the four-component tag starter after it validates the repository, tag/version contract, target suffix, and prior successful Build, test, and audit check
• remove its ability to dispatch mode=publish automatically
• reduce the tag workflow's Actions permission from write to read
• add a clear tag-run summary stating that nothing has been published and linking to the manual Deploy OreSpawn release form

After creating a valid release tag, the operator must now deliberately run the dispatcher and provide:

• mode: publish
• release ref: the exact version tag
• CurseForge channel: release, beta, or alpha
• confirmation: the exact version tag

The dispatcher then builds and audits the immutable bundle before stopping at the separate release environment approval gate. Maven, CurseForge, and GitHub publication cannot begin until that approval is granted.

Why

The original starter hard-coded publish, release, and the confirmation value immediately after a tag push. That removed the intended opportunity to inspect the tagged candidate, select the CurseForge release level, and explicitly confirm live publication.

Validation

• actionlint 1.7.12 passes all workflow files
• git diff --check passes
• a local guard confirms the tag workflow contains no gh workflow run, mode=publish, or actions: write path
• the active default-branch dispatcher still exposes mode, release_ref, curseforge_channel, and confirm_version, and retains the release environment gate

Publication boundary

Merging this PR does not create a tag, start the dispatcher, or publish any release.