fix: verify immutable signed release tags

[AlexMikhalev]

Summary

• fetch the annotated release tag object explicitly before verification
• bind both validation and publication jobs to the event commit SHA
• verify the trusted SSH tag signature immediately before publication
• document and test the immutable release-tag requirement

Protection

The active Immutable release tags ruleset protects refs/tags/v* from updates, deletion, and force-pushes with no bypass actors.

Validation

• 23 Python tests
• actionlint
• Ruff lint and format checks
• generator drift and deterministic archive checks
• strict distribution validation
• independent structured review: no P0/P1/P2 code findings