Align with thinc's workflow: trigger only on release-v*/prerelease-v*
tags instead of branch pushes/PRs, pin the reusable workflow to a
specific SHA, remove the now-unnecessary create-release input, and add
the retag_release job that re-points the draft release to a clean v* tag.