fix: skip stale release workflow runs

[giscebot]

Summary

• Check out the exact workflow SHA with full history before restoring the release branch.
• Skip validation and publication when main has advanced past the triggering SHA.
• Recheck the remote head immediately before semantic release.
• Add regression coverage and document the stale-run behavior.

Cause

Run 37429064394 checked out a newer shallow main after another PR merged, then could not reset to the older triggering SHA because that object was absent. Releasing that stale SHA would also be unsafe, so stale runs now finish without publishing and leave the newest queued run to release the current head.

Validation

• Focused workflow tests: 2 passed
• Full Python suite in a clean CI-like environment: 433 passed
• Real remote comparison identifies c8395f2 as stale against current main

Requested by: @pilipilisbot

[pilipilisbot]

Validated PR head 4b9176be6815978bc80960e3cdda4e0837dc670a.

What I checked:

• The release workflow now checks out the triggering ${{ github.sha }} with full history before restoring the branch name.
• Stale queued runs skip install/test/build/release when origin/${GITHUB_REF_NAME} no longer matches the triggering SHA.
• A second remote-head check gates python-semantic-release immediately before publishing.

Local validation:

• .venv/bin/pytest -q tests/test_release_workflow.py -> 2 passed
• .venv/bin/pytest -q -> 433 passed, 1 existing Starlette/httpx deprecation warning

No extra code changes were needed beyond the current PR diff.

[pilipilisbot]

Post-merge follow-up for PR #253:

• Merged as aff5fe429cf8bb9b30b2e2af74eb2e8f7de5ff0d.
• tests on main completed successfully for that merge commit.
• release run completed successfully: https://github.com/gisce/github-agent-bridge/actions/runs/37445083777
• Semantic release published v0.71.4.

Only follow-up noticed: GitHub emitted a non-blocking Node.js 20 deprecation annotation for some Actions versions; it did not block this release.