fix: prevent stale tags from poisoning publish version detection

Three issues caused publish failures:
1. Stale tags (e.g. v2.0.0 at merge commit) made commit-and-tag-version
   see zero new commits and default to patch bump (1.4.0 → 1.4.1)
2. commit-and-tag-version crashed on pre-existing tags with
   "fatal: tag already exists"
3. Release event path ignored the release tag version

Fix: clean stale local tags before bumping, use --skip.tag to separate
tag creation from versioning, and create tags manually with force-replace
for idempotent re-runs.

Author: github-actions[bot]

.github/workflows/publish.yml

@@ -128,15 +128,35 @@ jobs:
           CURRENT=$(node -p "require('./package.json').version")
 
           if [ "${{ github.event_name }}" = "release" ]; then
-            echo "Triggered by release event — using existing version $CURRENT"
+            # Extract version from the release tag instead of trusting package.json
+            TAG="${{ github.event.release.tag_name }}"
+            RELEASE_VERSION="${TAG#v}"
+            if [ "$CURRENT" != "$RELEASE_VERSION" ]; then
+              echo "::warning::package.json ($CURRENT) doesn't match release tag ($TAG) — bumping to match"
+              npx commit-and-tag-version --release-as "$RELEASE_VERSION" --skip.tag --skip.changelog
+            else
+              echo "Triggered by release event — version $CURRENT matches tag $TAG"
+            fi
           else
             OVERRIDE="${{ inputs.version-override }}"
+
+            # Remove stale local tags newer than current version — these are
+            # leftovers from prior failed runs and poison commit-and-tag-version's
+            # bump detection (it uses the latest tag as baseline for commit range)
+            for tag in $(git tag -l 'v*'); do
+              TAG_VER="${tag#v}"
+              if node -e "process.exit(require('semver').gt('$TAG_VER','$CURRENT')?0:1)" 2>/dev/null; then
+                echo "::warning::Removing stale local tag $tag (newer than v$CURRENT)"
+                git tag -d "$tag" || true
+              fi
+            done
+
             if [ -n "$OVERRIDE" ] && [ "$CURRENT" = "$OVERRIDE" ]; then
               echo "Version already at $OVERRIDE — skipping bump"
             elif [ -n "$OVERRIDE" ]; then
-              npx commit-and-tag-version --release-as "$OVERRIDE"
+              npx commit-and-tag-version --release-as "$OVERRIDE" --skip.tag
             else
-              npx commit-and-tag-version
+              npx commit-and-tag-version --skip.tag
             fi
           fi
 
@@ -225,4 +245,7 @@ jobs:
         if: github.event_name == 'workflow_dispatch' && !inputs.dry-run
         run: |
           git push origin main
-          git push origin "v${{ steps.version.outputs.new_version }}"
+          TAG="v${{ steps.version.outputs.new_version }}"
+          # Create annotated tag (force-replace if stale from a prior run)
+          git tag -fa "$TAG" -m "release: $TAG"
+          git push origin "$TAG" --force