Fix/release create tag before verify (#403)

* fix(release): create missing app-v tag before release verification

Ensure reusable publish creates and pushes the expected app-v tag when absent,
then validates it points to source_ref. This prevents release records with tag_name
but no git refs/tags object, which previously broke Source code archives.

* fix(release): pin tauri publish to tagged release metadata

Pass tagName/releaseName/releaseDraft/prerelease to tauri-action in addition to
releaseId, so asset upload fallback remains bound to the expected app-v release
instead of creating untagged releases.

* chore(ci): align workflow action versions for release flow

Update github-script usage to v9 across release-related workflows and keep
the current tauri-action release binding changes in the same branch for testing.

.github/workflows/validate-main-green-ci.yml

@@ -32,7 +32,7 @@ jobs:
       checks: read
     steps:
       - name: validate required checks
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         env:
           TARGET_BRANCH: ${{ inputs.branch || github.event.inputs.branch || 'main' }}
           REQUIRED_CONTEXTS: ${{ inputs.required_contexts || github.event.inputs.required_contexts || 'ci-ok|ci-main / ci-ok' }}