fix(ci): require master for delete-release workflow

[rozsazoltan]

Summary

• require the Delete Release workflow to run only from master
• make the workflow checkout explicit with github.token
• prevent rollback runs from compiling and executing a stale github-release binary from an older branch

Why

delete-release.yml bootstraps github-release from the current verzly/toolchain checkout:

cargo build --release -p github-release

That means the workflow does not use a published release binary. It runs whatever source code exists on the selected ref.

If the workflow is dispatched from an outdated or partially merged branch, rollback can execute old tag-repair logic even when master already contains the correct fixes. In practice this can leave inconsistent state behind, especially for partial delete cases where:

• vX.Y.Z is already missing
• <distribution>-vX.Y.Z may still exist in the monorepo
• vX.Y, vX, latest, and next still need to be recalculated or removed

This change turns that into a hard precondition so release deletion always runs from the canonical source of truth.

Changes

• add a source-ref validation step to delete-release.yml
• fail early when the workflow is not started from master
• keep the bootstrap path unchanged, but guarantee it compiles from the correct branch

Validation

• git diff --check