Keep release tag names out of shell source - #473

The major-tag step declared GITHUB_TOKEN: secrets.WORKFLOW_TOKEN, but git
never reads that variable. The push authenticates with the http.extraheader
credential actions/checkout persists, which is the default GITHUB_TOKEN, and
`refs/tags/v4` having no release proves it: a PAT-authored push would have
re-triggered create-release on the v4 tag. Record why the inertness is
load-bearing rather than leaving a line that reads like an oversight.

Also bound the guard test's step slice at the next step. Reading to
end-of-file only holds while the major-tag step is last in the file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015EmepbnR2nSdk8q8DBsrsD