fix: fetch annotated release tags explicitly

[Alex-ghost599]

Problem

The real v0.1.0 tag run checked out only the peeled commit, so the workflow could not inspect the annotated tag object and failed before build. A first fix also allowed a race where remote tag+main moved together while the runner remained on an older event checkout.

Changes

• fetch the exact remote tag ref before validating its annotated object
• require runner HEAD, event GITHUB_SHA, fetched tag peeled commit, and fetched origin/main to be identical
• fail closed for invalid ref names, missing/lightweight tags, stale main, missing/non-commit/mismatched event SHAs, and moved-tag races
• add real temporary bare-remote integration coverage
• bump the immutable next release candidate to 0.1.1 and document that v0.1.0 failed before build and must never be moved or reused

Verification

• 352 tests passed; coverage 91.46%
• focused release verifier matrix: 24 passed
• Ruff, mypy, build, twine, pip-audit, gitleaks, privacy history/identity, actionlint, bash syntax, and clean wheel smoke passed
• independent targeted re-review: PASS (0 Blocker / 0 Important / 0 Minor)

Boundaries

• v0.1.0 remains an immutable annotated tag at 5ad634c with no GitHub Release
• no tag was deleted, moved, or force-updated
• the real v0.1.1 tag workflow remains runtime evidence after promotion to main

Closes #45