fix: ensure semantic-release runs on exact workflow commit (#93)

- Add explicit ref checkout and force reset to workflow SHA
- This prevents GITHUB_TOKEN 401 errors when semantic-release tries to create releases for non-HEAD commits
- GITHUB_TOKEN can only create releases/tags for the current HEAD commit due to GitHub API limitations
- Based on GitHub community findings: https://github.com/orgs/community/discussions/121022

Author: fgogolli

.github/workflows/semantic-release.yml

@@ -43,6 +43,11 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
+          ref: ${{ github.ref_name }}
+
+      - name: Force branch to workflow SHA
+        run: |
+          git reset --hard ${{ github.sha }}
 
       - name: Setup Python and UV
         uses: ./.github/actions/setup-python-uv