GITHUB_TOKEN is the internal actions runner token — pushes made with it
don't trigger new workflow runs (by design, prevents infinite loops).
Using a real user PAT (SA_TOKEN_ACTION_PUSH_TAGS) makes the tag push
trigger the tag.yaml workflow correctly.
Fixes the issue where tag pushes from the 'tag' job didn't launch the
'Tag Release' pipeline (tag.yaml).