fix: use a lightweight tag so the release job needs no git identity

[Yash-Chindam]

Summary

• Manually dispatched release.yml after PR fix: dispatch the release workflow after a trusted merge #18 merged to bootstrap the repo's first tag/release and verify the pipeline end-to-end. The bump logic worked correctly (computed v0.1.0), but git tag -a failed with "Committer identity unknown" — the runner has no user.name/user.email configured, and an annotated tag needs one.
• Switches to a lightweight tag (git tag "$VERSION" "$RELEASE_SHA"), which needs no identity. The release notes already come from gh release create --generate-notes, so the annotated tag's -m message added nothing.
• Verified locally: reproduced the exact failure with an annotated tag and no identity, confirmed a lightweight tag succeeds under the same conditions.
• Nothing was left dangling from the failed run — it errored before git push, so no tag or release exists yet.

Test plan

• ruff format --check .
• ruff check .
• YAML-validated release.yml
• Reproduced the failure and the fix locally with a throwaway git repo and no configured identity
• After this merges, dispatch release.yml again to confirm v0.1.0 is tagged and released