fix(release): reject stale candidates before publication

[XuPeng-SH]

Summary

Stop a stale release before publication instead of adding release credentials. The v0.2.2 run selected a source that became historical while awaiting approval; the built-in token then received HTTP 403 creating its tag after main's workflow files changed.

Immediately before creating a new annotated tag, require the verified source to equal the current default-branch head. If main advanced, exit before tag or versioned Docker publication and tell the maintainer to start a new normal release run. No GitHub App, private key, PAT, or additional configuration is required.

The protected publication job retains contents: write on GITHUB_TOKEN, including all draft reads and verification. The shared tag reconciler preserves existing-tag ownership and exact object checks, same-run continuation, and recovery without moving tags. Candidate verification and the Environment publication gate remain in place.

Limits and recovery

The head check is not an atomic lock: a concurrent main update can still cause GitHub to refuse creation. Existing-tag recovery cannot bypass historical workflow permission restrictions; inspect partial publication on such failure rather than moving tags or overwriting assets. Busy development can require rebuilding candidates from a new main head.

Verification

• 13 release shell tests pass, including current-head creation, stale-head rejection before any GitHub API call, existing owned-tag continuation, draft visibility, repeated body reuse, and conflicting draft rejection.
• actionlint passes; git diff --check passes.
• No runtime or database changes; no Rust checks required.
• Full repository validation remains subject to the previously observed local macOS execution-lease contract failure; this is not a release end-to-end rehearsal.

Architecture and user impact

The release workflow remains the single controller; tag reconciliation is extracted to one script. Documentation describes restart instructions, publication ordering, and recovery limits. No unrelated issue is auto-closed.