Fix/release create tag before verify (#404)

* fix(release): create missing app-v tag before release verification

Ensure reusable publish creates and pushes the expected app-v tag when absent,
then validates it points to source_ref. This prevents release records with tag_name
but no git refs/tags object, which previously broke Source code archives.

* fix(release): pin tauri publish to tagged release metadata

Pass tagName/releaseName/releaseDraft/prerelease to tauri-action in addition to
releaseId, so asset upload fallback remains bound to the expected app-v release
instead of creating untagged releases.

* chore(ci): align workflow action versions for release flow

Update github-script usage to v9 across release-related workflows and keep
the current tauri-action release binding changes in the same branch for testing.

* fix(release): harden tagged release resolution for source-only promote

Canonicalize release_id via getReleaseByTag after create/update and fail fast on
invalid tag/commit inputs to avoid untagged release binding. Also propagate
source-only marker through promote push events so push-triggered channel runs
skip platform artifacts and verify-nix consistently.

.github/workflows/promote-next-to-release.yml

@@ -53,7 +53,11 @@ jobs:
             exit 0
           fi
           NEW_VERSION="$(node -p 'require("./package.json").version')"
-          git commit -m "chore(release): finalize release version ${NEW_VERSION}"
+          MSG="chore(release): finalize release version ${NEW_VERSION}"
+          if [[ "${{ inputs.source_only }}" == "true" ]]; then
+            MSG="${MSG} [source-only]"
+          fi
+          git commit -m "$MSG"
       - name: push release
         run: git push --force-with-lease origin HEAD:release
       - name: dispatch Release Channel workflow