fix(release): restore annotated tag refs

[pentaxis93]

Summary

• Restores annotated tag refs immediately after checkout in the release workflow.
• Verifies the restored tag still resolves to the triggering event SHA before the existing annotated-tag trust check runs.
• Documents the release workflow correction in the Unreleased changelog.

Changes

• Added the Restore annotated tag refs and Verify restored tag matches event workflow steps between Checkout and Require annotated tag.
• Tightened the release workflow repository-contract test to lock in the trust-step content and ordering.

GitHub Issue(s)

Closes #308

Test plan

• python -m unittest tests.test_release_ceremony.ReleaseRepositoryContractTests.test_release_workflow_verifies_annotated_tags_and_has_no_path_filter
• python -m unittest discover -s tests