fix: peel annotated tags in the broker's tag rule

[Verdenroz]

What changed

The broker's tag rule compared the default branch against the OIDC sha claim as given. For an annotated tag that claim can name the tag object rather than the commit under it, and the compare API rejects a tag object with a 404, which the broker would surface as a 502 and no release. The broker now asks for /git/tags/{sha} first and compares the commit it points at; a 404 there means the claim already named a commit and it is used as is.

• Added tagObject to the GitHub client (GET /repos/{repo}/git/tags/{sha}, undefined on 404).
• decideRef peels before comparing, with a two-line comment stating why the claim stays authoritative: tag objects are immutable.
• Tests at the client level and at the handler level (an object SHA is peeled to its commit before the compare).

Why

The tag rule exists so a release runs only code already on the default branch. The v0.3.0 run carried the commit SHA and passed, but the compare API's behaviour on a tag object was measured rather than assumed, and it fails. Peeling closes that without weakening the rule.

How was this tested

• npm test in bot/: 67 passed, 0 failed, including the two new tests.
• tsc --noEmit: clean.
• The next tag push deploys this through bot.yml and exercises it live.
• make check and make gate not run; no Rust changed.

Checklist

• make check passes (fmt, clippy -D warnings, cargo test --workspace)
• make gate BASE=master passes, or any intentional cost change is explained above
• Tests added/updated for new behavior (not required for docs/CI-only changes)
• Public API items have /// doc comments
• No new dependency, or its justification is included above (see Dependency Policy)
• Docs (README.md, docs/, soothfast:bind/soothfast:claim markers) updated if behavior changed

[soothfast-bot]

soothfast gate

gate: measuring merge-base of origin/master in worktree (interleaved rounds)
gate: bench binaries identical (code and data match) — no measurable change possible
gate: gating backend = walltime
gate: build=08f03a noise_floor=0.12% thresholds: instructions +5% ir +5% walltime +10.0% alloc/size +5% polls/wakes +5%
ok    soothfast_spec::bench_openapi_diff walltime_median_ns 6120165.0 -> 6120165.0 (+0.0%)
ok    soothfast_spec::bench_openapi_diff allocs 77722 -> 77722 (allowed <= 81608)
ok    soothfast_spec::bench_openapi_diff alloc_bytes 10815487 -> 10815487 (allowed <= 11356261)
ok    soothfast_spec::bench_openapi_document walltime_median_ns 1910757.0 -> 1910757.0 (+0.0%)
ok    soothfast_spec::bench_openapi_document allocs 30152 -> 30152 (allowed <= 31659)
ok    soothfast_spec::bench_openapi_document alloc_bytes 4715065 -> 4715065 (allowed <= 4950818)
ok    soothfast_spec::bench_serialize_yaml walltime_median_ns 6415007.0 -> 6415007.0 (+0.0%)
ok    soothfast_spec::bench_serialize_yaml allocs 74277 -> 74277 (allowed <= 77990)
ok    soothfast_spec::bench_serialize_yaml alloc_bytes 8533615 -> 8533615 (allowed <= 8960295)
ok    soothfast_spec::bench_openapi_diff assert complexity: claimed O(n); growth drift x1.70 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_spec::bench_openapi_document assert complexity: claimed O(n); growth drift x1.31 over sizes [16, 64, 256] (limit x2.5)
ok    soothfast_spec::bench_serialize_yaml assert complexity: claimed O(n); growth drift x1.27 over sizes [16, 64, 256] (limit x2.5)
gate: passed (3 item(s))