Add GitHub UI action for validated release tags

[SkyBlade1978]

Summary

• add a default-branch Create OreSpawn release tag workflow for the GitHub Actions UI
• ask for the target MMD branch/commit and the exact four-component version confirmation
• derive the tag name from the selected target's own mod_version rather than accepting an independent tag string
• validate Minecraft/loader target suffix metadata and require a successful Build, test, and audit check on the exact target commit
• refuse missing CI/CD metadata, an incorrect confirmation version, an unported tag workflow, or an existing tag
• create a lightweight tag pointing to the validated commit and then stop with a link to the separate deployment form

Nothing is published by this workflow. CurseForge channel selection and live-publication confirmation remain in Deploy OreSpawn release after the tag exists.

GitHub token behavior

GitHub deliberately suppresses ordinary push-triggered workflows for refs created with GITHUB_TOKEN. The tag Action therefore performs the same repository, metadata, version, target and prior-CI validation itself before creating the tag. It does not introduce a personal token or another secret, and it does not auto-dispatch publication.

Validation

• actionlint 1.7.12 passes the new workflow
• git diff --check passes for the workflow
• the fork commit contains exactly one changed path: .github/workflows/create-release-tag.yml
• fork commit: 5376bbd9771e870000c6a068e8a9630876287c7e

Operator flow

1. Open Actions → Create OreSpawn release tag → Run workflow.
2. Enter master-1.10.2 and 4.0.8.110021.
3. After the validated tag is created, open Deploy OreSpawn release.
4. Select publish, the tag, and release/beta/alpha, then type the version confirmation.

Merging this PR only adds the UI action. It does not create 4.0.8.110021 or publish a release.