fix(KAN-58): avoid admin API in macOS release workflow

.github/workflows/macos-release.yml

@@ -2,6 +2,8 @@ name: macOS release to Hetzner
 
 on:
   push:
+    # Gitea enforces the configured macos-v* protection when tags are pushed.
+    # Reading /tag_protections requires admin rights unavailable to job tokens.
     tags:
       - "macos-v*"
   workflow_dispatch:
@@ -69,24 +71,6 @@ jobs:
         with:
           node-version: 22
 
-      - name: Require protected macOS release tags
-        shell: bash
-        env:
-          GITEA_TOKEN: ${{ github.token }}
-        run: |
-          set -Eeuo pipefail
-          curl --fail --silent --show-error \
-            --header "Authorization: Bearer $GITEA_TOKEN" \
-            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/tag_protections" \
-            --output "$RUNNER_TEMP/macos-tag-protections.json"
-          node --input-type=module - <<'JS'
-          import { readFileSync } from 'node:fs';
-          const rules = JSON.parse(readFileSync(`${process.env.RUNNER_TEMP}/macos-tag-protections.json`, 'utf8'));
-          if (!rules.some((rule) => rule.name_pattern === 'macos-v*')) {
-              throw new Error('Configure a protected macos-v* tag rule in Gitea before publishing.');
-          }
-          JS
-
       - name: Validate app versions and Hetzner configuration
         env:
           RELEASE_TAG: ${{ steps.ref.outputs.tag }}