ci(release): gate the tag on the pull request CI instead of re-running checks

[rennf93]

Closes #47

I changed the Release Gate so it checks the same thing the pull request did instead of re-running checks at the tag.

• The tag comes from the v* tag push or from a new required tag input on workflow_dispatch, is validated against ^v[0-9]+\.[0-9]+\.[0-9]+$, and is checked out as refs/tags/<tag>.
• The PHP matrix and composer audit jobs are replaced by a Require green CI on the tagged commit step: the newest push run of ci.yml, static-analysis.yml, live-smoke.yml on the tagged commit must have concluded success, waiting up to an hour. The script and comment style are the ones from guard-core-rs (ci(release): publish a tag only from green CI, and re-drive by tag input guard-core-rs#156).
• Composer audit is dropped from the tag run: it is a job of ci.yml on the same commit and the same composer.json, so it is already covered by the ci.yml requirement. No check has to wait for the tag to exist, so the workflow is the single verify job.
• Docs that described the old flow are updated.

PR CI gap-filling: every command the old release workflow ran (php -l sweep, the bin/ runners, composer audit, PHP 8.2 to 8.4) is already in ci.yml on pull requests, so nothing needed adding.