validate commit sha when tagging

[quepcompute]

Description

Fix release workflow tagging commits that aren't on the main branch. Run #28 tagged 8653882 — an orphaned PR branch commit from a squash merge — producing a release pointing at a SHA unreachable from main.

Three changes:

• Branch guard: if: github.ref == 'refs/heads/main' prevents the release job from running when workflow_dispatch is triggered from a feature branch.
• github.sha fallback: Replaces ref: 'main' (resolves at checkout time, race-prone) with github.sha (fixed at trigger time).
• Commit validation: Before tagging, verifies the SHA is well-formed, exists in the repo, and is an ancestor of main via the compare API — modeled after sui-operations/.github/actions/validate-commit.

Test Plan

• Trigger workflow_dispatch from main with no commit_sha — should resolve to current main HEAD and pass validation
• Trigger workflow_dispatch with an explicit SHA from a merged-and-squashed PR branch — should fail at "not an ancestor of main"
• Push a Cargo.toml version bump to main — should auto-tag the correct squash-merge commit