Summary

Fixes release CI failing at manual-approval with:

403 Resource not accessible by personal access token

The approval step now uses GITHUB_TOKEN (workflow already grants issues: write). GORELEASER_TOKEN stays on the GoReleaser job only.

Also adds task release:remove to unwind a failed tag/release before retrying.

Usage

# After merging, re-tag for v0.13.0:
task release:remove -- v0.13.0   # optional — clean up failed attempt
task release -- v0.13.0          # push tag again once fix is on main

Test plan

• Workflow YAML validates (approval uses secrets.GITHUB_TOKEN)
• Merge to main, then re-push v0.13.0 or cut a new patch tag