Harden v2.0.1 release tag verification

[d-init-d]

Summary

• preserve and verify the remote annotated tag object in a private Git ref namespace
• bind the tag target to the checked-out source and require main ancestry
• add explicit failure diagnostics and a regression contract
• refresh v2.0.1 notes, changelog, and distribution manifest

Verification

• uv run --no-sync python scripts/release_gate.py --with-dev
• remote refspec smoke: tag object type, checked-out commit, and main ancestry all pass
• git diff --check

Root cause

actions/checkout fetches the peeled commit back into refs/tags/<tag> while checking out an annotated tag, so inspecting that local ref incorrectly reports a lightweight tag. The workflow now refetches the authoritative remote tag into refs/aleph-release-tags/<tag> before validation.