fix(release): fork-safe + tag-deletion guard + SHA pin + tag payload (Copilot round 2)

Author: intel352

.github/workflows/release.yml

@@ -42,12 +42,16 @@ jobs:
     permissions:
       contents: read
     needs: goreleaser
-    if: ${{ !contains(github.ref_name, '-') }}
+    if: >-
+      !github.event.deleted
+      && !contains(github.ref_name, '-')
+      && github.repository == 'GoCodeAlone/workflow-plugin-github'
     steps:
       - name: Trigger registry manifest sync
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697  # v4
         with:
           token: ${{ secrets.repo_dispatch_token }}
           repository: GoCodeAlone/workflow-registry
           event-type: plugin-release
-          client-payload: '{"plugin": "github"}'
+          client-payload: |-
+            {"plugin": "github", "tag": "${{ github.ref_name }}"}