Tag the dispatched sha in release-draft, not the checkout HEAD

The release tag must point at the commit the artifacts were built from (github.sha). The step tagged whatever the job checkout resolved to - the branch head at job START - so a commit pushed to main mid-run moved the tag target; when that head commit happened to touch .github/workflows/, the GitHub App token's tag push was rejected outright (refusing to create refs at workflow-modifying commits), failing the 0.8.0 draft.

Author: DeusData

.github/workflows/release.yml

@@ -148,8 +148,13 @@ jobs:
       - name: Create tag
         env:
           VERSION: ${{ inputs.version }}
+        # Tag the DISPATCHED sha, not the checkout HEAD: the artifacts were
+        # built from github.sha, and a commit pushed to main mid-run must not
+        # move the release tag. (A floating HEAD also broke the 0.8.0 release:
+        # HEAD had become a commit touching .github/workflows/, and the App
+        # token may not create refs pointing at workflow-modifying commits.)
         run: |
-          git tag -f "$VERSION"
+          git tag -f "$VERSION" "$GITHUB_SHA"
           git push origin "$VERSION" --force
 
       - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2