fix(release): bind recovery provenance to tags

[jmagar]

Summary

• reject release recovery runs unless GitHub is executing at the requested immutable tag ref
• preserve manual recovery with gh workflow run Release --ref <tag> -f tag_name=<tag>
• lock the provenance rule into the repository CI policy and changelog

Root cause

@dinglebear/rapprise@0.2.3 failed clean installs because its release recovery workflow was dispatched from main. GitHub signed the release asset with source ref/digest from that branch event, while the installer correctly required provenance from refs/tags/v0.2.3.

Verification

• bash scripts/check-ci-policy.sh
• npm test --prefix packages/apprise-rmcp (14/14)
• npm run check --prefix packages/apprise-rmcp
• branch-ref guard rejects refs/heads/main with rc 42
• tag-ref guard accepts refs/tags/v0.2.4
• git diff --check