release: harden upload pipeline (TAG/VER split, --fail-with-body, GITHUB_TOKEN, contents:write)

Aligns with the chip-plugin repos:
- Use TAG (with v prefix) for gh release create, VER (stripped) for
  Changelist lookup and upload.php's version field.
- curl --fail-with-body so server-side errors fail the workflow instead of
  passing silently.
- Switch GH_TOKEN to the auto-provided GITHUB_TOKEN with explicit
  contents:write permission, dropping the dependency on a per-repo
  ACCESS_TOKEN PAT.

tag.sh

@@ -13,5 +13,5 @@ if ! grep -q "^${VER}:*$" Changelist.txt; then
     exit 1
 fi
 
-echo "Tagging [$VER]"
-git tag "$VER" && git push origin "$VER"
+echo "Tagging [v$VER]"
+git tag "v$VER" && git push origin "v$VER"