Use GITHUB_TOKEN with contents:write in release workflow (#289)

Grant job-level contents:write permission so GitHub's ephemeral GITHUB_TOKEN can tag and publish releases directly without an expiring RELEASE_PAT secret. Pin actions/checkout to a commit SHA and replace the unpinned third-party zip/release actions and deprecated ::set-output script with standard zip and gh release create.

.github/scripts/set_release_version.py

diff --git a/.github/scripts/set_release_version.py b/.github/scripts/set_release_version.py
deleted file mode 100644
index 92c95dd..0000000
--- a/.github/scripts/set_release_version.py
+++ /dev/null
@@ -1,7 +0,0 @@
-# Obtains a date-based version for the release workflow.
-
-import datetime
-
-now_utc = datetime.datetime.now(datetime.timezone.utc)
-version = now_utc.strftime("%Y.%m%d.%H%M%S")
-print("::set-output name=version::v{}".format(version))

.github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 24a157d..96c2128 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,33 +1,28 @@
----
 name: Release
 on:
   push:
     branches:
       - 'master'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@master
-      - uses: actions/setup-python@master
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
-          python-version: '3.x'
-      - name: Set Release Version
-        id: set_release_version
-        run: python ./.github/scripts/set_release_version.py
-      - name: Create Archive Release
-        uses: thedoctor0/zip-release@master
-        with:
-          filename: 'emboss.zip'
-          exclusions: '*.git*'
-      - name: Automatic Release Upload
-        id: automatic_release
-        uses: 'marvinpinto/action-automatic-releases@latest'
-        with:
-          repo_token: '${{ secrets.RELEASE_PAT }}'
-          automatic_release_tag: ${{ steps.set_release_version.outputs.version }}
-          prerelease: false
-          title: ${{ steps.set_release_version.outputs.version }}
-          files: |
-            emboss.zip
+          persist-credentials: false
+      - name: Create and upload release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          version="v$(date -u +%Y.%m%d.%H%M%S)"
+          zip -r emboss.zip . -x '*.git*'
+          gh release create "${version}" emboss.zip \
+            --target "${GITHUB_SHA}" \
+            --title "${version}" \
+            --generate-notes