Bind signing OIDC to a GitHub environment

A federated credential scoped to a tag matches the subject literally, so
refs/tags/* never matched a real tag and token exchange failed with
AADSTS700213. Running the job in the `release` environment gives a
constant subject that holds across every version tag.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: dovvnloading

.github/workflows/release.yml

@@ -26,6 +26,11 @@ permissions:
 jobs:
   build:
     runs-on: windows-latest
+    # Binds the OIDC token's subject to `...:environment:release`, which stays
+    # constant across tags. A federated credential scoped to a tag would have
+    # to name one exact tag -- subjects are matched literally, so a wildcard
+    # like refs/tags/* never matches a real tag at token exchange.
+    environment: release
 
     steps:
       - uses: actions/checkout@v4