fix(get_repo): verify git tag exists before fetching (issue #10)

[claude]

Root cause

The cron build (run 27261205466) failed because:

1. The MS update API reported VS Code 1.123.2 at commit 3c631b164c239e7aeaaae7c626b46c527b361af2.
2. The cron's check job detected upstream (1.123.2) > pin (1.123.0) and set MS_COMMIT from the API response.
3. The build job ran get_repo.sh, which attempted git fetch --depth 1 origin 3c631b16....
4. Microsoft's GitHub repo had no 1.123.2 tag at that time (only 1.123.0 is tagged). git fetch returned fatal: remote error: upload-pack: not our ref 3c631b16....

The update API sometimes announces a binary release before the corresponding git tag is pushed to GitHub (typically a few-hour gap). The previous error message gave no indication of this timing issue.

Fix

get_repo.sh now runs git ls-remote origin "refs/tags/${MS_TAG}" before attempting the fetch:

• If the tag is absent → clear error: "Tag 1.123.2 is not yet present in microsoft/vscode … The next scheduled cron run will retry automatically."
• If the tag is present but with a different commit than the API reported (force-push scenario) → adopt the git-authoritative hash so the fetch succeeds.

What this doesn't change

• PR builds test the pinned version (1.123.0 today), so CI is unaffected.
• The cron will keep failing until Microsoft pushes the 1.123.2 tag — this PR improves the error message and robustness; it does not change when the build attempts run.

Deeper fix (needs human action)

The ideal prevention is in the check job of cron-build-and-release.yml: run git ls-remote before deciding needs_build=true, so the expensive macOS runner never starts for a version whose tag isn't in git. That change requires workflows: write permission which the Claude App's GITHUB_TOKEN does not currently have. A repo admin can apply it with a PAT that has workflow scope.

Refs #10