Fix annotated release tag validation

[timharris707]

Summary

• explicitly refetch the remote tag ref before validating annotated-tag type
• retain strict SemVer and main-reachability gates without moving v0.7.0
• add a regression assertion for fetch-before-validation ordering

Evidence

The first v0.7.0 run failed safely because actions/checkout locally dereferenced the annotated tag to a commit. The remote tag remains annotated and unchanged.

• node --test scripts/*.test.mjs (7/7)
• npm run lint
• npm run typecheck
• git diff --check
• independent hotfix review: clean