[codex] Harden sbom-diff-and-risk release asset automation

[stacknil]

Summary

• keep this follow-up strictly within sbom-diff-and-risk release asset automation
• make publish-release-assets use explicit repo context for all gh release operations
• fetch full tag/history context before using gh release create --verify-tag

Notes

• no CLI behavior changes
• current remote main already has checkout@v5 and setup-python@v6 in the sbom-diff-and-risk workflows, so this PR does not churn those versions further
• workflow_dispatch sanity check passed on this branch: run 24742814836
• the publish-release-assets job is still tag-gated, so the exact release-asset path will be fully exercised on the next v0.4.x or later tag