fix(ci): refuse a signed build that is not on a tag

[JamieRuderman]

Why

Build / Electron dispatched from main with skip_signing unchecked (2026-09-15, v3.48.10) signed all 24 Windows binaries and then discarded them: only a tag build creates the draft and publishes into it, and the run was green with just a notice saying so. The signatures are billed per file.

What

• prepare gets a first step that fails before checkout when skip_signing is off and github.ref_type is not tag. Unsigned branch builds are unaffected.
• RELEASE.md section 2 says to dispatch from the version tag and why.

Verified

• Run 35031584404: branch + signing on → the guard fails in the first step, nothing checked out, the release matrix skipped.
• Run 35031615693: branch + signing off → the guard is skipped and prepare passes (run cancelled after that to save minutes).

[JamieRuderman]

@codex review

[aws-amplify-us-west-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-1223.d20k671nqqv4kl.amplifyapp.com

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 7cc6de7019

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".