fix(release): gate Gitee release on matching tag SHA

[stephamie7]

Summary

• resolve the exact commit behind the published GitHub release tag
• create the same tag on Gitee by pushing the exact Git tag object
• fail safely when an existing Gitee tag points to a different commit
• verify GitHub and Gitee tag SHAs match before creating or updating the Gitee Release
• process only the current release instead of scanning historical releases and attachments

Root cause

The previous third-party release sync created the Gitee Release before repository source synchronization had completed. Because it forwarded target_commitish=main, Gitee could create the new version tag from a stale main, causing the new tag archive to contain old source code.

Impact

China-region upgrades that consume Gitee tag archives are now protected by an explicit SHA gate. A Gitee Release cannot be created when its tag is missing or points to a different commit, and existing release tags are never force-moved.

Validation

• actionlint .github/workflows/sync-gitee.yml
• YAML parsing
• Bash syntax validation for every workflow run block
• git diff --check

Notes

• the existing GITEE_TOKEN secret must have both Release API access and repository tag push permission
• this workflow no longer copies custom GitHub Release attachments; Gitee tag-derived source archives remain available