fix: defer plugin signing until approval (#18)

The v1.4.8 release failed because passing `policy_token` attempted to sign this public plugin before Grafana review has granted a signature level, and the signing service returned a 409 InvalidArgument.

This defers plugin signing by disabling the `policy_token` input for now, keeps provenance attestation enabled, and bumps the package version to 1.4.9 for a clean release tag.

Author: everpcpc

.github/workflows/release.yml

@@ -25,4 +25,4 @@ jobs:
           go-version: '1.25'
           node-version: '24'
           attestation: true
-          policy_token: ${{ secrets.GRAFANA_ACCESS_POLICY_TOKEN }}
+          # policy_token: ${{ secrets.GRAFANA_ACCESS_POLICY_TOKEN }}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "datasource-databend",
-  "version": "1.4.8",
+  "version": "1.4.9",
   "description": "Grafana datasource plugin for Databend",
   "scripts": {
     "build": "webpack -c ./.config/webpack/webpack.config.ts --env production",