gitflow-release.yml: tag + back-merge + invoke release on master merge (replaces tag.yml)

[haydenk]

Parent

Part of #14

What to build

Replace .github/workflows/tag.yml with .github/workflows/gitflow-release.yml (mirrors haydenk/homestead). On PR-closed-merged into master from release/* or hotfix/*:

1. Tag master's merge commit with the stripped version (date-based: YYYYMMDD or YYYYMMDD.NN).
2. Open chore/back-merge-<version> PR (master → develop) and immediately merge via gh pr merge --merge --delete-branch (no --auto — develop ruleset bypasses CI for github-actions[bot], see Branch protection rulesets: master + develop (with github-actions[bot] bypass on develop) #22).
3. Call release.yml via workflow_call with the tag input.

PAT-less: uses GITHUB_TOKEN only. The bot-bypass on develop is required and tracked in #22.

Acceptance criteria

• Merging a release/YYYYMMDD PR to master tags, back-merges, and triggers the full release
• Merging a hotfix/YYYYMMDD.NN PR follows the same path
• Back-merge PR auto-merges within seconds; develop never drifts
• tag.yml deleted
• No third-party actions
• PAT-less

Blocked by

• Make release.yml callable: workflow_call + dry_run + RELEASE_TAG #16 (release.yml callable)
• Dagger Notes fn + gh release create: remove softprops/action-gh-release #20 (Notes + gh release pattern)