Changed: improve release safety and consolidate error handling

Ensure cargo publish uses the lockfile for reproducible releases.
Refactor the tag_release script to use a single exception handler
for various process and validation failures.

Author: acgetchell

docs/RELEASING.md

@@ -194,10 +194,10 @@ gh release create "$TAG" --notes-from-tag
 
 ```bash
 # Sanity check before publishing
-cargo publish --dry-run
+cargo publish --locked --dry-run
 
 # Publish the crate (ensure docs are already updated on main via the PR)
-cargo publish
+cargo publish --locked
 ```
 
 ---

scripts/tag_release.py

@@ -278,15 +278,15 @@ def main() -> None:
 
     try:
         create_tag(args.version, force=args.force)
-    except (ValueError, FileNotFoundError, LookupError) as exc:
+    except (
+        ValueError,
+        FileNotFoundError,
+        LookupError,
+        ExecutableNotFoundError,
+        subprocess.CalledProcessError,
+    ) as exc:
         print(f"Error: {exc}", file=sys.stderr)
         sys.exit(1)
-    except ExecutableNotFoundError as exc:
-        print(f"Error: {exc}", file=sys.stderr)
-        sys.exit(1)
-    except subprocess.CalledProcessError as exc:
-        print(f"Error: git command failed: {exc}", file=sys.stderr)
-        sys.exit(1)
 
 
 if __name__ == "__main__":