Simplify OreSpawn release action and add approval gate

[SkyBlade1978]

Summary

• replace the separate tag and four-field deploy forms with one release action containing only the OreSpawn version and CurseForge release level
• derive the target branch from the fourth version component, then validate the branch metadata and exact successful Build, test, and audit check
• build the immutable bundle before pausing at GitHub's native release environment approval gate
• create the exact version tag only after approval, then publish Maven -> CurseForge -> GitHub
• apply alpha/beta/release only to CurseForge; GitHub always receives an ordinary release
• fail closed unless the release environment has required reviewers, includes SkyBlade1978, and permits self-review

One-time repository setup

An MMD repository administrator must configure Settings -> Environments -> release with required reviewers (SkyBlade1978 and optionally KiriCattus) and leave Prevent self-review disabled. The workflow refuses to build or publish until that protection is present.

Validation

• actionlint 1.7.12
• workflow-only git diff --check
• routing checks for Forge 1.10.2, 1.12.2, 1.18.2, 26.2 and NeoForge 1.20.6, 1.21.11, 26.2