DEVEX-1087: handle annotated -main tags in promote-release-candidate

[pdodgen-revparts]

Fixes [remote rejected] failures on the "Reset target branch" step when the -main.N tag is annotated.

Root cause

mathieudutour/github-tag-action can produce either lightweight or annotated tags. When annotated:

• git rev-parse TAG returns the tag object SHA, not the commit
• git push +refs/tags/TAG:refs/heads/rc tries to set a branch ref to the tag object
• GitHub rejects this because branch refs must point to commits

Catalog_api happened to have lightweight -main tags, so the bug was invisible until we rolled out to rp_api, checkout, and internal_api (which have annotated -main tags).

Fix

1. Resolve via git rev-parse TAG^{commit} (no-op for lightweight, dereferences annotated)
2. Push the commit SHA directly (+$SHA:refs/heads/rc) instead of the tag ref

Observed in

• encodium/rp_api run 24679969202
• encodium/checkout run 24679989169
• encodium/internal_api (after re-run picked up the fresh -main tag)

Part of DEVEX-1087.

[cursor]

PR Summary

Medium Risk
Changes the release-candidate promotion workflow’s source resolution and force-push logic, which can affect how the rc (or target) branch is reset during releases. Risk is limited to CI/release automation but could mis-point the target branch if tag/commit resolution is wrong.

Overview
Updates the promote-release-candidate GitHub Actions workflow to correctly promote annotated *-main.N tags by resolving the tag to its underlying commit (git rev-parse TAG^{commit}) and then force-pushing that commit SHA to the target branch.

This avoids GitHub rejecting branch updates that mistakenly point at tag objects, while preserving behavior for lightweight tags.

^{Reviewed by Cursor Bugbot for commit d60cf45. Bugbot is set up for automated code reviews on this repo. Configure here.}