fix: verify existing release tags before creation

[sarveshsea]

Summary

• reproduce the protected-tag recovery failure in the workflow contract
• read and validate an existing immutable tag before attempting Git ref creation
• preserve atomic creation, exact SHA checks, 404-only creation, and 422 race recovery

Test plan

• node scripts/check-release-workflows.mjs (RED before workflow fix, GREEN after)
• node --test tests/release-supply-chain.test.mjs
• npm run verify

Live context

The exact protected v5.1.0 tag already resolves to reviewed release commit c26ad054f999ea726eb29c93d75e5a0dd8a7ea7e. This makes the final GitHub release job safely recoverable without asking the workflow token to recreate that tag.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}