ci: support immutable tag publication recovery

[codeforester]

Summary

• add an explicit release_tag input for manual protected PyPI recovery
• check out and archive the selected annotated tag, not the workflow dispatch branch
• bind release metadata, provenance, and immutable GitHub Release verification to that tag commit
• preserve ordinary tag-triggered publication behavior

Why

The v0.5.0 tag workflow was immutable and used the pre-fix publisher action. After #450 updated the default branch, a normal rerun would still execute the old tag workflow. This gives the release process a guarded recovery path without moving or recreating the tag.

Validation

• python3 -m pytest -q tests/test_package_workflow.py
• ./tests/validate.sh
• git diff --check

Refs #451