fix(permission-gate): guard release-* branch and v* tag pushes (deploy convention)

Deploy convention at M.Video: a release-* branch push deploys to stage and a
v* tag push deploys to PROD. The old guard only matched release/* (slash) and
never caught tag pushes, so a prod deploy could run unconfirmed.

- permission-gate: match main/master, release-[-/], --tags/--follow-tags, and
  whitespace-preceded v<digit> tags; false-positive-safe (space discriminator)
- create-mr.sh: refuse source branch release-* (not just release/*)
- jira-workflow doc updated to release-*

Verified with a behavioral test suite (10 cases incl. v2, false-positive checks).

skills/jira-workflow/SKILL.md

@@ -52,7 +52,7 @@ GITLAB_TOKEN=... ./scripts/create-mr.sh "Fix PROJ-123: NPE" main "" PROJ-123
 
 Флаги окружения `create-mr.sh`: `GITLAB_TOKEN` (обязателен), `GITLAB_HOST` (override хоста),
 `MR_PUSH=0` (не пушить ветку), `MR_DRY_RUN=1` (показать запрос без вызова API).
-MR из защищённой ветки (`main`/`master`/`release/*`) скрипт создавать откажется.
+MR из защищённой/релизной ветки (`main`/`master`/`release-*`) скрипт создавать откажется.
 
 ## Соглашения
 

skills/jira-workflow/scripts/create-mr.sh

@@ -26,8 +26,8 @@ JIRA_KEY="${4:-}"
 
 # --- Refuse to open an MR *from* a protected branch (safety). ----------------
 case "$SOURCE" in
-	main | master | release/*)
-		echo "Refusing: source branch '$SOURCE' looks protected. Create a feature branch first." >&2
+	main | master | release-* | release/*)
+		echo "Refusing: source branch '$SOURCE' looks protected/release. Create a feature branch first." >&2
 		exit 1
 		;;
 esac