release pipeline refactor

[wagoodman]

quick pass refactoring yardstick's release CI (python project, so the go-specific bits don't apply):

• dropped dependabot grouping so updates come as individual PRs
• zizmor.yml trimmed to rules: {} (removed the unpinned-uses config)
• added a skip-checks workflow_dispatch input and made check-gate skippable; the tag job now runs even when check-gate is skipped but still requires version-available to pass
• gave check-gate the contents: read permission it was missing
• switched the tag job to push tags with TAG_TOKEN (via the checkout token) instead of the default GITHUB_TOKEN, so it doesn't inherit workflow permissions