Pin release tag to CI-verified commit via target_commitish

On the executable path there is no create-tag job, so
action-gh-release auto-creates the tag when the release job runs.
Set target_commitish to github.sha so the tag points at the commit
that passed CI in guard, not whatever is main HEAD at release time.
No-op on the library path where the tag already exists.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ejfine

template/.github/workflows/release.yaml.jinja

@@ -406,6 +406,7 @@ jobs:
         uses: softprops/action-gh-release@{% endraw %}{{ gha_action_gh_release }}{% raw %}
         with:
           tag_name: v${{ needs.guard.outputs.version }}
+          target_commitish: ${{ github.sha }}
           name: {% endraw %}{{ repo_name }}{% raw %} v${{ needs.guard.outputs.version }}
           generate_release_notes: true{% endraw %}{% if deploy_as_executable %}{% raw %}
           fail_on_unmatched_files: true