fix(release): pre-create the tag via refs API so GITHUB_TOKEN can publish

[githubrobbi]

Problem

The v0.6.14 release (run #135) failed at the publish step:

👩‍🏭 Creating new GitHub release for tag v0.6.14 using commit "ce5abac…"
⚠️ GitHub release failed with status: 403
{"message":"Resource not accessible by integration", …}

All three binaries built fine — only action-gh-release's POST /releases 403'd. Root cause (confirmed via cli/cli#9514): creating a release with a commit-SHA target_commitish under the GITHUB_TOKEN integration now returns "Resource not accessible by integration" (began ~2026-06; PATs are unaffected, which is exactly why the bot fails but a user token succeeds). Repo/org settings, workflow permissions (token had Contents: write), and rulesets were all verified permissive — it's the API endpoint, not config.

Fix (no PAT — eliminates the failure mode, doesn't defer it)

Split tag creation from release creation:

1. Create the tag ref at the built commit via POST /git/refs — not subject to the workflow-file push guard that rejects git push origin $TAG (run #24795626228), and a plain contents:write op rather than the release-with-target endpoint that 403s.
2. action-gh-release attaches the release to the now-existing tag with no target_commitish → sidesteps the cli#9514 403.

Why this over a PAT:

• No secret to mint, rotate, or leak — a fine-grained PAT expires and re-introduces this exact silent breakage in N months.
• Least privilege — keeps the auto-scoped, per-run GITHUB_TOKEN.
• No double-release — a GITHUB_TOKEN-created tag doesn't re-trigger this push: tags: v* workflow (a PAT-pushed tag would).
• Build-commit pinning preserved — we tag inputs.commit_sha directly.
• Idempotent — skips tag creation if it already exists (re-run / tag-push path).

After merge

Re-dispatch release.yml for v0.6.14 (workflow_dispatch, commit ce5abac) to publish the full 45-asset release via the real pipeline.