Add idempotent tag creation with SHA validation to release workflow

[Copilot]

Addresses feedback on #41: tag creation step lacked error handling for re-runs and existing tags with mismatched SHAs.

Changes

• Check tag existence before creation: Query GitHub API to determine if tag already exists
• Idempotent behavior: Skip tag creation if tag exists at same SHA, log and succeed
• Fail-fast on conflicts: Throw error if tag exists at different SHA, preventing silent overwrites

# Before
github.rest.git.createRef({
  ref: `refs/tags/${tag}`,
  sha: context.sha
})

# After
let existingTag = await github.rest.git.getRef({ ref: `tags/${tag}` });
if (existingTag) {
  if (existingTag.data.object.sha === context.sha) {
    console.log('Tag exists at same SHA. Skipping.');
    return;
  }
  throw new Error(`Tag exists at different SHA: ${existingTag.data.object.sha}`);
}
// ... create tag

Workflow can now be safely re-run without failures from duplicate tags at the same commit.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.