Bind Dagger release candidates to exact tag SHA

[hseshadr]

Fix

Close the final release identity gap: a Dagger candidate now requires the existing remote tag, current main, requested commit, and successful hosted Dagger check to identify the same 40-character commit SHA.

The tag is URL-encoded before the fixed GitHub API request, reduced into the strict Pydantic payload, and checked before Dagger refetches/builds the immutable source.

TDD evidence

• RED: tag SHA was rejected by the strict payload as an unknown field and fetch accepted no tag
• GREEN: focused 9 tests; root gate 472 tests / 98.40%; Dagger module Ruff + strict mypy + Xenon A + 5 tests; full local Dagger graph green in 1m40s

No tag, dispatch, artifact, publication, OIDC request, or registry mutation performed.