fix(release): check out the tag, never a branch of the same name

[sanskarIN]

The build jobs checked out the release by its short name. actions/checkout prefers a branch over a tag with the same name, so with a v1.0.0 branch in the repository the release would have built that branch instead of the tagged commit. Every checkout now uses the full refs/tags/ reference.

What this changes

Why

How it was tested

Checklist

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, and cargo test --workspace --locked pass
• For web changes: npm run format:check, npm run typecheck, and npm test pass
• New or changed findings carry evidence, a method, and limitations, and have tests with realistic samples
• No network access, telemetry, or execution of repository code was added to the analysis
• Documentation in docs/ is updated, and user-visible changes are listed under "Unreleased" in CHANGELOG.md