[squarepots]

本 PR 让每次 release 都从准确的现有版本 tag 构建，并在任何构建开始前确认 checkout source 与版本一致。workflow_dispatch 只接受现有版本 tag；tag push 使用触发 workflow 的 tag。

scripts/verify-release-source.mjs 会将 annotated 或 lightweight tag 解析到 commit，要求 checkout 的 HEAD 与该 commit 完全一致，并核对 package.json、Tauri 配置、Cargo manifest 和 Cargo lock 中的版本。Tauri release 名称、tag 名称和 updater metadata 使用同一个已验证 tag；手动恢复只能重新发布该现有 tag，不会从无关的当前 main 构建历史版本。

验证

• pnpm test:release-source：2 个 focused tests 通过
• pnpm build：TypeScript 编译和 Vite production build 通过
• git diff --check：通过

Closes #163

---

This PR builds every release from an exact existing version tag and verifies that the checked-out source matches that version before any build begins. workflow_dispatch accepts only an existing version tag, while a tag push uses the tag that triggered the workflow.

scripts/verify-release-source.mjs resolves annotated or lightweight tags to commits, requires the checked-out HEAD to equal that commit, and checks the versions in package.json, the Tauri configuration, Cargo manifest, and Cargo lock. The Tauri release name, tag name, and updater metadata all use the verified tag. Manual recovery can only republish that existing tag and cannot build a historical version from unrelated current main source.

Validation

• pnpm test:release-source: 2 focused tests passed
• pnpm build: TypeScript compilation and the Vite production build passed
• git diff --check: passed

Closes #163