fix: fix check_release workflow to actually validate releases

- Was a no-op: 'push' event never fires when called via workflow_call from release
- Validate bare semver tag format (e.g. 1.2.3, not v1.2.3)
- Validate release targets main, hotfix/*, or release/* branch

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jimisola

.github/workflows/check_release.yml

@@ -1,11 +1,21 @@
-name: Lint (black and flake8)
+name: Check Release
 on:
   workflow_call:
 
 jobs:
   check-release:
     runs-on: ubuntu-latest
     steps:
-      - name: Check branch and tag
-        if: github.event_name == 'push' && !(github.ref == 'refs/heads/main' && startsWith(github.ref, 'refs/tags/v'))
-        run: exit 1
+      - name: Check tag format
+        run: |
+          if ! echo "${{ github.ref }}" | grep -qE '^refs/tags/[0-9]+\.[0-9]+\.[0-9]+'; then
+            echo "Tag must be a semver version like 1.2.3 (no v prefix)"
+            exit 1
+          fi
+      - name: Check branch
+        run: |
+          branch="${{ github.event.release.target_commitish }}"
+          if [[ "$branch" != "main" && "$branch" != hotfix/* && "$branch" != release/* ]]; then
+            echo "Release must target main, hotfix/*, or release/* branch (got: $branch)"
+            exit 1
+          fi