ci(release): restore prerelease guard on retry-sign-release publish jobs (MCP-3020) (#743)

Re-target of #737 to main. The original PR was based on the already-merged
fix/mcp-2905 branch and merged there, so the guard never reached main.

Skips update-homebrew and publish-linux-repos in retry-sign-release.yml for
prerelease tags (containing '-', e.g. -rc.*), mirroring release.yml — prevents
the retry path from publishing prerelease artifacts to stable channels.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Dumbris

.github/workflows/retry-sign-release.yml

@@ -399,7 +399,7 @@ jobs:
     needs: release
     runs-on: ubuntu-latest
     environment: production
-    if: github.repository == 'smart-mcp-proxy/mcpproxy-go'
+    if: github.repository == 'smart-mcp-proxy/mcpproxy-go' && !contains(inputs.tag, '-')
 
     steps:
       - name: Checkout tap repository
@@ -585,7 +585,7 @@ jobs:
   # Publish signed apt/yum repositories to Cloudflare R2 (mirrors release.yml)
   publish-linux-repos:
     needs: [release]
-    if: github.repository == 'smart-mcp-proxy/mcpproxy-go'
+    if: github.repository == 'smart-mcp-proxy/mcpproxy-go' && !contains(inputs.tag, '-')
     runs-on: ubuntu-latest
     environment: production