Fix deploy-prod tag clobber and add validate to make dev

[sebastientaggart]

make deploy-prod was failing with "would clobber existing tag" rejections when local release tags diverged from the remote. Split the combined pull into a branch rebase plus a forced tag fetch so the remote remains authoritative for release tags.

Also wire ./sync.sh --validate into make dev so placeholder validation runs alongside the dry-run preview as a preflight check.

Closes #89

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

• [NOTE] The git fetch origin --tags --force in deploy-prod will overwrite any local release tags to match the remote, which is the intended authoritative behavior described in the PR and matches the fix for Fix 'make deploy-prod' failing when local tags diverge from remote tags #89.
• [NOTE] Adding ./sync.sh --validate before ./sync.sh --dry-run in the dev target correctly fails fast on placeholder errors since make halts on the first non-zero exit.