fix: pin checkout to tag ref for build and publish jobs

Ensures build, cargo-publish, npm-publish, and pypi-publish all
checkout the exact tagged commit, matching the original workflow
behavior. Prevents building from a different commit if main
advances between tag creation and build.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Wenxin-Jiang

.github/workflows/release.yml

@@ -122,6 +122,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: v${{ needs.version.outputs.version }}
           persist-credentials: false
 
       - name: Install Rust
@@ -203,6 +204,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: v${{ needs.version.outputs.version }}
           persist-credentials: false
 
       - name: Install Rust
@@ -242,6 +244,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: v${{ needs.version.outputs.version }}
           persist-credentials: false
 
       - name: Configure git for HTTPS
@@ -323,6 +326,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: v${{ needs.version.outputs.version }}
           persist-credentials: false
 
       - name: Download all artifacts