Surface the Forge API response in the tag_deploy Forge step

[silug]

curl --fail discards the response body, so a failed Forge publish reports only a bare HTTP status — the simp-gpasswd 2.0.0 release died with an unexplained 403 (valid token, new-module creation refused; the Forge's JSON error would have said why outright).

The deploy step now captures the response body and status via --write-out/--output, prints both, and fails on any non-2xx result. Same upload semantics otherwise (also quotes the find properly, replacing the odd ''*.tar.gz'' quoting).

Note for #42: that branch rewrites tag_deploy.yml wholesale — I've applied the same step change there so the two merge cleanly in either order.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XCnDsYaJDLiP8z8tafz9Tp

[silug]

Added a second robustness improvement prompted by the gpasswd post-mortem: the built module archive is now uploaded as a workflow artifact before the Forge POST, so every tag run — pass or fail — leaves the exact tarball downloadable from the run page (previously a failed upload left nothing: no artifact, and the GitHub release carries no assets). Mirrored to #42 as before.

[silug]

Third improvement: the module archive is now also attached to the GitHub release (gh release upload --clobber, default GITHUB_TOKEN — same token the release-creation job already uses). Assets are permanent and public, unlike workflow artifacts (authenticated, 90-day expiry), and the upload happens before the Forge POST so a failed publish still leaves the exact archive on the release page. Note: prerelease tags skip this whole job (existing if:), so prereleases get neither Forge nor assets — unchanged behavior. Mirrored to #42.