fix(ci): pin release tag to triggering commit via --target GITHUB_SHA

Without --target, gh release create tags the latest commit on the
default branch, which may differ from the commit that built the
artifacts. Pin to $GITHUB_SHA so the tag always matches the built ref.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/promote-release.yml

@@ -158,6 +158,7 @@ jobs:
         run: |
           gh release create "${{ needs.validate.outputs.tag }}" \
             --repo "${{ github.repository }}" \
+            --target "$GITHUB_SHA" \
             --title "${{ needs.validate.outputs.tag }}" \
             --latest \
             --generate-notes \

.github/workflows/release.yml

@@ -142,6 +142,7 @@ jobs:
         run: |
           gh release create "${{ needs.version.outputs.tag }}" \
             --repo "${{ github.repository }}" \
+            --target "$GITHUB_SHA" \
             --title "${{ needs.version.outputs.tag }}" \
             --prerelease \
             --generate-notes \