Harden release workflow correctness for tag-based builds and reruns

[Copilot]

This updates the release workflow to address PR feedback around correctness and safety in manual/tag-driven releases. The workflow now guarantees assets are built from the intended tag and keeps release metadata consistent on reruns.

• Ref/tag correctness

  • Resolve release tag first, then checkout that exact ref in both build and release jobs.
  • Prevents workflow_dispatch from building default-branch code while publishing under a different tag.

• Publish path clarity

  • Switch dotnet publish target to explicit project file:
    • src/Tm7.Cli/Tm7.Cli.csproj
  • Removes ambiguity from directory-based publish invocation.

• Release safety guardrails

  • Add explicit tag-existence verification before release operations.
  • Add gh release create --verify-tag to avoid accidental tag creation from unintended commits.

• Rerun metadata consistency

  • When a release already exists, update name, body, and prerelease state before uploading assets.
  • Aligns rerun behavior with “create or update release” expectations.

- uses: actions/checkout@... # v5
  with:
    ref: ${{ steps.ver.outputs.tag }}

- name: Verify tag exists
  run: git rev-parse --verify "refs/tags/${{ steps.ver.outputs.tag }}"

- name: Create / update release
  run: |
    if gh release view "$TAG" ...; then
      gh api --method PATCH "repos/$GITHUB_REPOSITORY/releases/$RELEASE_ID" \
        -f name="$TAG" -f body="$NOTES" -F prerelease="$PRE"
      gh release upload "$TAG" ... --clobber dist/*
    else
      gh release create "$TAG" --verify-tag ...
    fi

[Copilot]

Pull request overview

Adds a dedicated GitHub Actions workflow to build and publish NativeAOT tm7 binaries for multiple OS/architectures and attach them (plus checksums) to GitHub Releases when a version tag is pushed or the workflow is manually dispatched.

Changes:

• Introduces a Release workflow triggered by v* tags and workflow_dispatch, with contents: write to create/upload release assets.
• Builds a cross-platform RID matrix, packages outputs as .zip (Windows) or .tar.gz (Linux/macOS), and emits per-asset *.sha256 files.
• Aggregates matrix artifacts in a final job and uploads them to an existing or newly created GitHub Release.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.