ci: tag-exists pre-flight + demote proxy-warm to advisory

[millerjp]

Summary

1. If a release dispatch fails mid-job and is re-dispatched, tag will fail on duplicate push, but goreleaser still runs on the inputs.tag checkout (the gate only covers dry-run vs tag-skipped, not tag-push-failure).
2. proxy-warm failures mark the release as failed even when the release is fully published — a proxy indexing delay makes the UI look broken.

Scope

• Add an explicit git ls-remote --exit-code --tags origin "refs/tags/$TAG" check at the top of the goreleaser job — fail fast if a live (pushed) tag doesn't correspond to this run.
• Add continue-on-error: true to proxy-warm OR split it into a separate workflow_dispatch-triggered workflow that a maintainer can re-run.

Acceptance criteria

1. Re-dispatch with an existing tag exits cleanly at the pre-flight with a message.
2. Proxy indexing delay doesn't flag the release as failed.

Source: devops + security-reviewer.