fix(release): verify release-please product tags

[f0rr0]

Summary

• make grouped release PR titles parseable by release-please while staying compatible with already-merged PR chore(release): superseded product release prep #80
• add a publish-time gate that verifies every selected release product tag exists at the release commit before any assets or registry packages publish
• refresh exact product tags from origin before verification so tags created by release-please after checkout are visible to later publish steps
• pin the release policy/config checks so this cannot regress silently

Root Cause

The grouped release PR title chore(release): prepare product releases had no release-please parser placeholders. On publish, release-please found PR #80 but could not parse its title, so it created no product tags/releases and exited successfully. The first asset publish then failed on the missing liboliphaunt-native-v0.1.0 tag.

This keeps PR #80 recoverable because the new grouped pattern parses both the old title (product) and future generated titles (main).

After Merge

Run the Release workflow from main with:

• operation: publish
• release_commit: leave empty unless you intentionally want to publish a specific full commit SHA

Expected behavior after this fix: release-please creates the product tags/releases first, Verify release-please product tags fetches and verifies all selected <product>-v<version> tags at the release commit, then publishing begins. If release-please ever creates no tags again, the workflow fails before any publish step runs.

Validation

• tools/dev/bun.sh tools/release/release-check.mjs
• tools/dev/bun.sh tools/release/check_release_please_config.mjs && tools/dev/bun.sh tools/policy/check-release-policy.mjs
• expected current-main pre-release failure: tools/dev/bun.sh tools/release/verify_product_tags.mjs --products-json '["liboliphaunt-native"]' --target origin/main