fix(release): verify backfills from workflow source

[solomonneas]

Summary

• Keep the workflow source checkout at the workspace root during publish jobs.
• Check out the requested release tag into tagged-source/ for release identity verification.
• Run post-upload smoke from the current workflow source so older tags do not need to contain the new smoke script.

Refs escoffier-labs/brigade#354

Root cause

Backfill run https://github.com/escoffier-labs/graphtrail/actions/runs/29675398558 uploaded all 11 assets, then failed because the job had checked out v0.4.0, which predates scripts/release-smoke.sh.

Test plan

• Contract test observed RED before the workflow change
• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features
• cargo build --release
• Shellcheck for release scripts
• PR CI and five-target release workflow pass
• Rerun v0.4.0 backfill and verify all 11 assets plus ten checksum lines

Completion receipt: 20260719-060101-work-verify-cba4dc.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e093c7f5-a572-4e64-8f6c-25362cfef331

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/issue-354-backfill-smoke-fix

---

_{Comment @coderabbitai help to get the list of available commands.}