ci(release): pass release tag via env in winget job

Match the hardening applied to the release, homebrew and notify-discord
jobs in 9cc4937: interpolate inputs.tag and github.event.release.tag_name
into env vars rather than into the run script body.