[shtse8]

What

Build each existing release from its immutable tag commit instead of the newer main commit that happens to trigger the workflow.

• Add releaseCommit: a full-SHA target_commitish is used directly; a branch-named tag is fetched and resolved with git rev-parse vX^{commit}.
• Only a release that does not exist yet falls back to GITHUB_SHA.
• The existing canonical checkout and native identity checks then build and attest the same source as the tag, preventing SourceRepositoryDigest mismatches during wheel recovery.

Verification

• Full Bun suite: 30 tests passed, including the new cases for full-SHA tags, branch-named tags, and no existing release.
• The new test proves an older tag wins over a newer GITHUB_SHA and that invalid tag identities fail closed.
• git diff --check passed.

No publication, tag mutation, package upload, or production data change was performed by this PR.