fix(release): restore annotated tag refs before trust checks

[pentaxis93]

Summary

• Restores annotated tag refs after actions/checkout@v4 so release tag-push workflows validate the original annotated tag object instead of checkout's lightweight local rewrite.
• Extends release metadata validation and workspace contract coverage so the refetch stays before the annotated-tag trust check.
• Adds an Unreleased changelog entry for the release workflow fix.

Changes

• Adds git fetch --tags --force origin immediately after release checkout and before tag-trust checks.
• Requires release workflows to restore annotated tag refs before checking git cat-file -t.
• Covers missing and late refetch cases in release metadata tests.

GitHub Issue(s)

Refs tesserine/commons#34

Test plan

• cargo fmt --check
• ./scripts/release-check metadata
• cargo test -p agentd --test release_check
• cargo test -p agentd --test workspace_contract
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace