Add explicit token inputs to the checkout and softprops/action-gh-release steps so the GitHub token is wired through instead of relying on implicit defaults. The workflow-level contents: write permission already scopes the token correctly for tag/release creation.