Harden release workflow tag handling

[NateIsern]

Motivation

• Close a command-injection vector where ${{ github.ref_name }} was interpolated directly into multi-line run: scripts during packaging, allowing crafted tag names to execute commands on runners.
• Minimize workflow privileges and ensure only validated SemVer tags produce published release artifacts to protect the release supply chain.

Description

• Add default workflow permissions: contents: read and preserve contents: write only on the create-release job to minimize token privileges.
• Add a Validate release tag step to each build job that sets TAG_NAME from ${{ github.ref_name }} and rejects tags that do not match a strict SemVer regex.
• Change packaging steps to pass the tag through an environment variable (TAG_NAME), construct package_dir variables and quote all shell expansions to avoid shell interpolation of untrusted input.
• Replace direct tag interpolation in artifact upload paths with safe glob patterns and remove if: always() so the release job only runs after successful builds.

Testing

• Executed a python3 regex validation with representative valid and invalid tags and it passed.
• Parsed the modified workflow YAML using Ruby (YAML.load_file) and it parsed successfully.
• Ran git diff --check to ensure no whitespace/errors and it reported clean results.

---

Codex Task