fix(release): pin build.yml dispatch to the release tag ref

prerelease.yml triggered build.yml without --ref, so the build ran on the
default branch (main), where package.json is still the previous stable
version. The RC version bump lives only on the release branch / RC tag, so
build.yml's publish-release guard rejected it ("package.json version 1.6.0
does not match 1.7.0-rc.1 from tag v1.7.0-rc.1") and no release was created.

Pass --ref so the build checks out the tag's tree (bumped package.json +
frozen code). Apply the same pin in promote.yml for the stable build, which
previously only worked because the main-merge happened to leave main at the
stable version first.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: EtienneLescot

.github/workflows/prerelease.yml

@@ -133,7 +133,14 @@ jobs:
           # GITHUB_TOKEN tag pushes don't fire the build.yml trigger in this setup,
           # so dispatch it explicitly. The PAT ensures the build's release creation
           # propagates to Tier 3 (homebrew/winget/nix/aur) via release: published.
+          #
+          # --ref is REQUIRED: the RC version bump lives ONLY on the release branch /
+          # RC tag, never on the default branch. Without --ref the build runs on main
+          # (still the previous stable version), so build.yml's publish-release step
+          # fails its guard ("package.json version X does not match <rc> from tag").
+          # Pin the build to the RC tag so checkout gets the bumped package.json + code.
           gh workflow run build.yml \
+            --ref "${RC_TAG}" \
             -f release_tag="${RC_TAG}" \
             -f arch=both \
             --repo "$GITHUB_REPOSITORY"

.github/workflows/promote.yml

@@ -142,7 +142,13 @@ jobs:
         run: |
           set -euo pipefail
           # GITHUB_TOKEN tag pushes don't fire build.yml in this setup, dispatch it.
+          #
+          # --ref pins the build to the stable tag (the frozen release-branch tip). The
+          # prior main-merge step usually leaves main at the stable version already, but
+          # relying on that is fragile; building the tag guarantees checkout has the
+          # matching package.json + code and enables signing/notarization (tag has no '-').
           gh workflow run build.yml \
+            --ref "${STABLE_TAG}" \
             -f release_tag="${STABLE_TAG}" \
             -f arch=both \
             --repo "$GITHUB_REPOSITORY"