Release tag job: App token also requests workflows permission (GH013 on 0.11.44)

tsk-t52k2y39rm8w review KTW Coder 001 (ktw-coder-001)

The release tag push fails when main has moved on with a workflow change during a release run.

What happened (0.11.44, run 42209897101): the run built on e640a3d. #765 (Dependabot, .github/workflows/hol-scanner.yml) was merged 37 seconds after the run started. GitHub then refused the App's push of dashboard-v0.11.44 with GH013: "refusing to allow a GitHub App to create or update workflow … without workflows permission". Compared with main, the new tag ref looks as if it changes a workflow file. Oliver set the tag by hand (a8328de → e640a3d).

Oliver's decision (req-4qys5fs092vs, option A):

The App keep-the-why-release-tags gets "Workflows: Read and write". Oliver does this in the App's settings and accepts the updated installation.
Every tag-minting step requests permission-workflows: write next to permission-contents: write, in publish-lint.yml, publish-dashboard.yml and release.yml.

Also:

docs/security.md and CONTRIBUTING: the App's permissions, and the recovery path (a re-run of the tag job does not help on a run that started before this fix).
The context entry 208bee54: add the GH013 incident and why workflows is needed (no wider risk than contents: write already has, and the key stays behind env release). This is its own commit.
CHANGELOG under Unreleased/CI, as is usual for workflow changes.

The PR must not merge before Oliver confirms the App permission. Otherwise the token request for workflows fails and the next tag job breaks.