Release this repo with tamci instead of gh-release #160

What

.github/workflows/release.yaml releases this repo through the local gh-release.yaml (git-cliff) twice: once for the umbrella vX.Y.Z tag, and once per reusable workflow through a matrix (<workflow>-vX.Y.Z). The house standard for release-only repos is DND-IT/tamci/actions/release@v0, and gh-release.yaml is meant to be used only inside service-pipeline. This repo should release itself with tamci.

Why it matters

• It keeps one releaser across DND-IT and puts fixes in one place. feat(datadog): build missing chart dependencies in datadog-cr-validate #159 had to patch gh-release.yaml so a per-workflow release also watches actions/<name>/, because the reusable workflow runs its action from its own tag's SHA.
• tamci's .release.yaml packages: (name, path, tag-pattern) matches the per-workflow tags, so the hand-built matrix in prepare-matrix could become config.

Gaps in tamci to close first

Checked against DND-IT/tamci internal/release and actions/release/action.yaml:

1. Version alias tags. gh-release moves v4 / v4.5 and <workflow>-v0 / <workflow>-v0.2 (update_version_aliases: true). Every consumer pins those aliases, for example datadog-cr-validate.yaml@datadog-cr-validate-v0 and tf-plan.yaml@v3. tamci release has no alias support.
2. Several paths per scope. include-path and packages[].path take one glob. A workflow that ships an action needs .github/workflows/<name>.yaml plus actions/<name>/** (the behaviour feat(datadog): build missing chart dependencies in datadog-cr-validate #159 adds to gh-release).
3. PR preview. release.yaml runs on pull_request in dry-run mode to preview each release. tamci has dry-run, so this should only need wiring. Worth confirming that the output still shows the computed tag per package.

Suggested approach

1. Add alias tags and multi-path scopes to tamci release (DND-IT/tamci).
2. Replace release.yaml with a checkout (fetch-depth: 0) plus DND-IT/tamci/actions/release@v0, driven by a .release.yaml with one package per reusable workflow. Keep the umbrella v prefix and the existing <workflow>-v tag patterns so current pins keep resolving.
3. Mint the token with actions/create-github-app-token from FISSION_GH_APP_ID / FISSION_GH_APP_PRIVATE_KEY and pass it as github-token, as today.
4. Keep notify-slack and drive it from the tamci outputs (release-published, version).
5. Leave gh-release.yaml itself in place while service-pipeline still uses it.