chore: CI workflow improvements

[Pessimistress]

• Use Node 18
• Use access token with stricter scope
• Explicit hash for external tasks
• Handles unannotated git tag in the CI context

[chrisgervang]

What's security/release model?

Is the security model that only authorized people can push to branches?

Is release done when a new tag is made, or triggered by something?

[Pessimistress]

This repo does not do CI releases yet. Push permission is limited for master, gh-pages, and *-release branches. They are managed in the repository settings.