fix: force-tag full release and gate discussion on publish

## What

Added -f flag to full tag creation and push in the create_release job,
and gated the release_discussion job on inputs.publish.

## Why

Without -f, workflow reruns fail with "tag already exists" when the full
tag was created before a downstream job failed. The short tag already
used -f, so this was an inconsistency. The discussion job ran
unconditionally, which would announce draft releases publicly before
they were published.

## Notes

- Force-pushing tags rewrites git history for that tag — acceptable here since the tag points to the same commit on rerun
- Callers using `publish: false` will no longer get discussion announcements, which is a behavior change for any existing consumers relying on that

Signed-off-by: jmeridth <jmeridth@gmail.com>

Author: jmeridth

.github/workflows/release.yaml

@@ -114,9 +114,9 @@ jobs:
           echo "SHORT_TAG=$short_tag" >> "$GITHUB_OUTPUT"
       - name: Create and push tags
         run: |
-          git tag "${{ steps.release-drafter.outputs.tag_name }}"
+          git tag -f "${{ steps.release-drafter.outputs.tag_name }}"
           git tag -f "${{ steps.get_tag_name.outputs.SHORT_TAG }}" "${{ steps.release-drafter.outputs.tag_name }}"
-          git push origin "${{ steps.release-drafter.outputs.tag_name }}"
+          git push -f origin "${{ steps.release-drafter.outputs.tag_name }}"
           git push -f origin "${{ steps.get_tag_name.outputs.SHORT_TAG }}"
 
   release_goreleaser:
@@ -287,7 +287,7 @@ jobs:
 
   release_discussion:
     needs: create_release
-    if: ${{ needs.create_release.outputs.full-tag != '' }}
+    if: ${{ inputs.publish && needs.create_release.outputs.full-tag != '' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read # Required by harden-runner