fix(ci): build release artifacts from computed tag

[eschaar]

Summary

Fix release packaging determinism to prevent publishing incorrect versions to PyPI.

• Updated release build job to checkout the computed release tag (refs/tags/${{ needs.release.outputs.version }}) instead of building from a moving branch ref.
• Added a pre-build version guard that compares poetry version -s against the computed release version and fails fast on mismatch.
• Updated changelog to include this fix under 1.3.2.

Related Issues

• PyPI publish used incorrect package version (0.0.0) instead of the intended release version.

Validation

• Tests pass locally
• CI checks pass
• Docs updated (if needed)

Release Impact

• fix: (patch)
• feat: (minor)
• BREAKING CHANGE (major)
• No release impact

[Copilot]

Pull request overview

This PR improves release packaging determinism to prevent publishing an incorrect version to PyPI by ensuring the build uses the computed release tag and adds a pre-build version guard.

Changes:

• Build job now checks out refs/tags/${{ needs.release.outputs.version }} instead of building from a moving branch ref.
• Added a “Validate package version” guard step intended to fail fast when the built version doesn’t match the computed release version.
• Updated CHANGELOG.md to document the fix under 1.3.2.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
CHANGELOG.md	Documents the release determinism/version-guard fix under the 1.3.2 entry.
.github/workflows/release.yml	Adjusts build checkout to the computed tag and adds a pre-build version validation step.