release pipeline refactor

[wagoodman]

quick pass refactoring go-macholibre's release pipeline:

• release.yaml: swapped DEPLOY_KEY for TAG_TOKEN in the ci-release step (for pushing tags; doesn't inherit workflow permissions)
• release.yaml: added a skip-checks workflow_dispatch input, made check-gate skippable via if: ${{ !inputs.skip-checks }}, and added the always()-based conditional on the release job so it still runs when checks are skipped (but not when version-available fails or check-gate fails/cancels)
• release.yaml: added contents: read to check-gate permissions (it only had checks: read)
• bumped go-make to v0.7.0 in .make
• dropped dependabot grouping (go-minor-patch + actions-minor-patch) so updates come as individual PRs
• zizmor: removed the unpinned-uses config, leaving rules: {}
• swapped goimports for the native gci formatter in golangci-lint (no source reformatting resulted)

note: no manual tag/push step existed (ci-release already handles tagging via go-make), so nothing to remove there.