fix(release): floating-tag updates in separate job and exact ref resolution

[c-vigo]

Description

Fixes release workflow errors when updating floating tags (vX, vX.Y): moves floating-tag updates to a separate job, resolves tags via the exact "Get a reference" API to avoid wrong SHA from prefix matches, and keeps rollback self-contained. Also fixes immutable release upload failures by generating and attaching checksums-sha256.txt during gh release create.

Type of Change

• fix -- Bug fix
• feat -- New feature
• docs -- Documentation only
• chore -- Maintenance task (deps, config, etc.)
• refactor -- Code restructuring (no behavior change)
• test -- Adding or updating tests
• ci -- CI/CD pipeline changes
• build -- Build system or dependency changes
• revert -- Reverts a previous commit
• style -- Code style (formatting, whitespace)

Modifiers

• Breaking change (!) -- This change breaks backward compatibility

Changes Made

• Floating-tag updates (Release 0.2.1 failed — automatic rollback #38): Run in a separate job after the release job succeeds; main rollback no longer restores floating tags. Resolve floating tags via GET /repos/{owner}/{repo}/git/ref/tags/{tag} instead of matching-refs to avoid wrong SHA from prefix matches. New job captures current SHAs, updates tags, and on failure restores from captured SHAs (self-contained).
• Immutable release uploads: Generate checksums-sha256.txt before creating the GitHub release and attach it during gh release create instead of uploading afterward.

Changelog Entry

### Fixed
- **Release workflow avoids immutable-release upload failures**
  - Generates `checksums-sha256.txt` before creating the GitHub release and attaches it during `gh release create` instead of uploading afterward
- **Release workflow: floating-tag updates and rollback** ([#38](https://github.com/vig-os/sync-issues-action/issues/38))
  - Floating-tag updates (vX, vX.Y) run in a separate job after the release job succeeds; main rollback no longer restores floating tags
  - Resolve floating tags via exact "Get a reference" API (`git/ref/tags/$TAG`) instead of `git/matching-refs` to avoid wrong-SHA from prefix matches
  - New job captures current SHAs, updates tags, and on failure restores from captured SHAs (self-contained)

Testing

• Tests pass locally (npm test)
• Manual testing performed (describe below)

Manual Testing Details

Release workflow changes validated via CI and release dry-run / integration test flows.

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have updated the documentation accordingly
• I have updated CHANGELOG.md in the [Unreleased] section (and pasted the entry above)
• My changes generate no new warnings or errors
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Additional Notes

Floating-tag update logic is isolated in a dedicated job so that release creation and asset uploads complete first; tag updates and their rollback are independent of the main release rollback.

Refs: #38