Support Git tags and tag patterns as deployment and update triggers #717

Problem Description

Projects backed by a Git repository (including multi-service Docker Compose stacks such as Noodle Gallery) currently only support branch-based deployment and update triggers.

1. GitHub Push Webhook Limitation:
   OpenShip's GitHub push webhook handler (webhook-push.ts) explicitly ignores non-branch pushes:

   if (!ref?.startsWith("refs/heads/")) {
     return { success: true, event: "push", message: `Ignoring non-branch ref: ${ref ?? "unknown"}` };
   }

   Tag pushes (refs/tags/*) are skipped, preventing automatic deployment on new repository releases/tags.

2. Compose Projects Cannot Use Release Sources:
   While single-image/archive projects can use releaseSource to track GitHub Releases (Support release mode and update tracking for container image projects #694 / feat(updates): add container release mode support #691), multi-service Compose projects with a composePath (like Noodle Gallery) cannot use releaseSource and must be Git-backed.

3. No Wildcard / Tag Pattern Support:
   Setting gitBranch to a tag or tag pattern (e.g. refs/tags/*, tags/*, v*) is not evaluated against upstream repository tags for drift detection or manual redeployments.

Expected Behavior

• Accept refs/tags/* in GitHub push webhook handling and match against projects configuring exact tag names, tag refs (refs/tags/...), or tag wildcard patterns (refs/tags/*, tags/*, v*, *).
• Rebuild multi-service Compose projects when a tag is pushed without skipping services due to empty commit diffs (forceAll: true on tag pushes).
• Support tag discovery and semver resolution in resolveUpstreamDrift and build.service so projects tracking tag patterns display update drift and deploy the latest matching tag.

Related Pull Request

Implemented in #716