Stop release tooling from exposing GH_TOKEN or deleting unrelated archives

**Priority: P0 — complete before the next release.** ## Problem `kg-microbe.Makefile` defines a `git_remote` target that embeds `GH_TOKEN` in the Git remote URL before release commands run. The expanded command can appear in Make output, and the credential remains in `.git/config` after the command completes. The same release path uses broad `rm -f *.tar.gz` cleanup, which can remove archives that were not created by the current run. ## Proposed change - Remove the `git_remote` target and its dependency from release targets. - Let `gh` authenticate through its normal `GH_TOKEN` environment handling without modifying `origin`. - Track the exact archives created by the current run and remove only those files when cleanup is required. - Keep release logs free of credential-bearing URLs and token values. ## Acceptance criteria - [ ] Running the release or prerelease target never changes `git remote get-url origin`. - [ ] No token is written to `.git/config`, the package tree, command output, or generated artifacts. - [ ] Release publication works with `GH_TOKEN` supplied only through the process environment. - [ ] Cleanup names an explicit set of generated archives and preserves unrelated `*.tar.gz` files. - [ ] A regression test or safe dry-run check covers both remote preservation and cleanup scope. ## Files - `kg-microbe.Makefile` - Any release tests or scripts introduced by the fix