[rennf93]

Closes #60

The release workflow of guard-core-jvm re-gated at the tag (a tag-push trigger and tests at the tag), after the tag was already immutable, and a manual re-drive read the ref instead of an input. This mirrors Guard-Core/guard-core-rs#156: the release workflow runs no lint or test of its own.

• verify: resolves the tag from the release event or the manual tag input (^v[0-9]+\.[0-9]+\.[0-9]+$), checks it out, compares it to the package version(s) (and refuses a -SNAPSHOT version), and requires the newest push run of ci.yml and ecosystem-gate.yml on that commit to have succeeded (it waits up to an hour).
• publish: checks the tag out explicitly and publishes the engine then the facade to the Central Portal exactly as before (same secrets, same USER_MANAGED upload), skipping an artifact already on Maven Central. ci.yml no longer filters push runs by path, so a docs-only tagged commit still gets the run verify requires.

A re-drive is Actions > Release > Run workflow with the tag; it checks the tag out with master's fixed workflow. The tag-push trigger and the tests at the tag are gone.

Tested locally: actionlint clean (the only warnings are pre-existing and identical on master). I ran the CI check step against real commits: the latest release tag passes and a commit whose CI failed is refused. After merging I will dispatch the release with the current latest tag to prove the re-drive path; every package is already published, so publish skips.