[MEDIUM] Isolate gem builds from release credentials

[OskarEichler]

Summary

• Build and validate the gem in a read-only job before any publishing identity is available.
• Pass that exact artifact to the RubyGems push and propagation-check jobs.
• Remove dependency installation, repository checkout, and the source-write token from the credentialed publishing job.

Why

The current tag job grants id-token: write, configures RubyGems credentials, creates a GitHub write-token remote, and then runs bundle install plus rake release in the same job. GitHub token and OIDC permissions apply to the complete job, so compromised build-time dependency code can run while publishing identities are available.

This split keeps gem construction in a contents: read job. The publishing job receives only the already-built artifact, configures trusted publishing immediately before gem push, and has no checkout or dependency installation. The final propagation check also uses the same artifact without release credentials.

Verification

• Parsed the workflow as YAML.
• Verified every action selector is an exact 40-character commit.
• Verified the tag/version guard with v3.2.1.
• Built jwt-3.2.1.gem successfully on rbenv Ruby 4.0.6.
• Extracted the expected jwt:3.2.1:ruby tuple from the built artifact.
• Ran git diff --check.

I did not perform a live GitHub Actions release or publish a gem.

Breaking changes

None for runtime or package contents. This changes release orchestration only: the workflow now publishes the artifact produced by the preceding build job.