fix(sdk-release-workflows): use moving backend origin tags

[gavinsharp]

Summary

SDK origin release tags now use a stable backend-origin/... namespace so finalization no longer tries to create GitHub tags that begin with raw 40-character SHAs.

Changes & impact

SDK repos using the shared release gate will receive moving backend-origin/<originGitCommit> origin tags, and the old origin-tag-prefix input is removed from the reusable workflow contract.

Details

• sdk-release-finalize advances backend-origin tags to newer release commits and leaves already-newer tags in place
• Moving backend-origin tag updates are force-pushed with a lease against the freshly observed remote tag, so concurrent finalizers cannot overwrite newer remote state from stale local refs
• sdk-release-gate and sdk-release-finalize reject tag names that still start with a 40-character SHA before publish/finalization proceeds
• README documents the new origin tag shape

Testing

• git diff --check
• actionlint .github/workflows/sdk-release-gate.yml .github/workflows/sdk-release-finalize.yml

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2ba99d0. Configure here.}