fix(packaging): harden Snap release inputs

cx

.github/workflows/release-snap.yml

@@ -39,6 +39,12 @@ concurrency:
   group: release-snap-${{ github.ref }}
   cancel-in-progress: false
 
+env:
+  # snapcore/action-{build,publish}@v1 still declares node20. Hosted runners
+  # already execute them successfully on Node 24; make that migration explicit
+  # before the Node 20 runtime is removed on 2026-09-16.
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
+
 jobs:
   version:
     runs-on: ubuntu-24.04
@@ -52,6 +58,9 @@ jobs:
 
       - name: Resolve and validate package version
         id: release
+        env:
+          DISPATCH_TAG: ${{ inputs.tag }}
+          DISPATCH_PUBLISH: ${{ inputs.publish }}
         run: |
           set -euo pipefail
           if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
@@ -71,14 +80,32 @@ jobs:
             echo "::error::crates/Cargo.toml workspace version ($CARGO_VERSION) != requested version ($VERSION)."
             exit 1
           fi
+          if [[ "$GITHUB_EVENT_NAME" == workflow_dispatch && "$DISPATCH_PUBLISH" == true && -z "$DISPATCH_TAG" ]]; then
+            echo "::error::Manual publishing requires an explicit release tag"
+            exit 1
+          fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Verify tag is on main
-        if: startsWith(github.ref, 'refs/tags/')
+        if: startsWith(github.ref, 'refs/tags/') || inputs.publish
+        env:
+          VERSION: ${{ steps.release.outputs.version }}
         run: |
-          git fetch origin main
-          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
-            echo "::error::Tag ${GITHUB_REF#refs/tags/} is not on main. Releases are cut from main only."
+          set -euo pipefail
+          tag="v${VERSION}"
+          git fetch origin main --tags
+          if ! git show-ref --verify --quiet "refs/tags/${tag}"; then
+            echo "::error::Release tag ${tag} does not exist."
+            exit 1
+          fi
+          tag_sha="$(git rev-parse "refs/tags/${tag}^{commit}")"
+          checkout_sha="$(git rev-parse HEAD)"
+          if [[ "$tag_sha" != "$checkout_sha" ]]; then
+            echo "::error::Checked-out commit does not match ${tag}."
+            exit 1
+          fi
+          if ! git merge-base --is-ancestor "$tag_sha" origin/main; then
+            echo "::error::Tag ${tag} is not on main. Releases are cut from main only."
             exit 1
           fi