release pipeline refactor

[wagoodman]

quick pass refactoring go-sync's release pipeline:

• release.yaml: swapped DEPLOY_KEY for TAG_TOKEN in the ci-release step (for pushing tags; doesn't inherit workflow permissions)
• added a skip-checks workflow_dispatch input and wired check-gate to be skippable via if: ${{ !inputs.skip-checks }}
• added the always()-based if on the release job so it runs when check-gate is skipped but still requires version-available to succeed
• added contents: read to the check-gate job permissions (it only had checks: read)
• bumped go-make to v0.7.0 in .make
• dropped dependabot grouping (go-minor-patch / actions-minor-patch) so updates come as individual PRs
• removed the unpinned-uses config from zizmor (now just rules: {})
• swapped goimports for the native gci formatter in golangci-lint

no separate manual tag/push step existed, so nothing to remove there. make format produced no source import changes.