Fix signed release tag verification

[magetsu002]

Summary

• verify the remote annotated tag through the GitHub API
• require a valid GitHub tag signature
• require the tag target to match the workflow commit
• avoid relying on the peeled local tag reference created by actions/checkout