Fix auto-release workflow to checkout tested commit

[RAprogramm]

Closes #41

Problem

CodeQL identified P1 security issue in auto-release.yml:

This workflow is triggered by workflow_run after the CI job succeeds, but actions/checkout@v4 is invoked without a ref and therefore checks out whatever happens to be at main when the job starts. If another commit lands on main before this job begins (for example a version bump whose CI run is still in progress or even fails), the release pipeline will tag and publish that newer code despite it never having completed CI.

Impact

Critical race condition: If a new commit is pushed to main while auto-release is running, it will release untested code.

Scenario:

1. Commit A pushed to main → CI starts
2. Commit B pushed to main → CI starts
3. Commit A CI succeeds → auto-release triggered
4. auto-release checks out main HEAD (now Commit B)
5. Commit B code is released without CI passing

Solution

Use github.event.workflow_run.head_sha to checkout the exact commit that passed CI:

- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.workflow_run.head_sha }}  # ← ADDED
    fetch-depth: 0

Changes

Before:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0

After:

- uses: actions/checkout@v4
  with:
    ref: ${{ github.event.workflow_run.head_sha }}
    fetch-depth: 0

Benefits

• Security: Only tested commits are released
• Correctness: Release matches CI-tested code
• Reliability: No race conditions

Testing

• Workflow syntax validated
• CodeQL warning will be resolved
• Will be tested on next release

References

• CodeQL Security Alert on PR Add automatic release workflow #40
• GitHub workflow_run event documentation