fix(ci): validate release tag matches release name before publishing

[njbrake]

Description

Adds an early validation step to the release workflow that compares the git tag with the GitHub release name (stripping optional v prefix from both). If they don't match, the workflow fails immediately with a clear error message before any code is checked out or published to PyPI.

This prevents the scenario described in #952 where a release titled "1.12.0" was accidentally tagged as "1.11.1", causing version 1.11.1 to be published to PyPI.

PR Type

• 🐛 Bug Fix

Relevant issues

Fixes #952

Checklist

• I understand the code I am submitting.
• I have added unit tests that prove my fix/feature works
• I have run this code locally and verified it fixes the issue.
• New and existing tests pass locally
• Documentation was updated where necessary
• I have read and followed the contribution guidelines
• AI Usage:
  • No AI was used.
  • AI was used for drafting/refactoring.
  • This is fully AI-generated.

AI Usage Information

• AI Model used: Claude Opus 4.6

• AI Developer Tool used: Claude Code

• Any other info you'd like to share: N/A

• I am an AI Agent filling out this form (check box if true)

Note: No unit test added because this is a GitHub Actions workflow change — the validation is a simple shell string comparison that runs as a CI step. It cannot be meaningfully tested with pytest.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
see 42 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.