ci(release): pin package tags to release targets

[JSONbored]

Summary

• Resolve release versions to the first mainline target commit that contains the release metadata commit.
• Only publish immutable package tags when the current build SHA is that resolved release target.
• Validate and publish GitHub Releases against the release target commit.

What changed

• Added a release-target helper for merge, squash, and direct release commit flows.
• Removed manual-dispatch tag publication from non-target SHAs.
• Added unit coverage for squash/direct and merge-with-intervening-main-commit cases.

Why

• Prevents existing aio release tags from being republished from newer non-release code.
• Fixes release publication when the release commit is merged through a mainline merge commit.

Validation

• .venv-local/bin/python -m py_compile scripts/release.py tests/unit/test_release_helpers.py
• .venv-local/bin/python -m pytest tests/unit/test_release_helpers.py -q
• .venv-local/bin/python -m pytest tests/unit tests/template -q
• trunk check --ci scripts/release.py tests/unit/test_release_helpers.py .github/workflows/build.yml .github/workflows/publish-release.yml docs/releases.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0653ec55e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[JSONbored]

Follow-up on the fetch-depth review: this was a real issue. The publish job checkout was still shallow, so merged release PRs could fail to resolve the underlying chore(release) commit. Fixed in 489799d by setting fetch-depth: 0 on the publish checkout and adding tests/unit/test_workflow_release_checkout.py to catch this workflow regression.