fix: ensure builds use correct git ref for version

The build workflows were checking out the original commit instead of the
tag created by semantic-release, causing binaries to have old versions.

Changes:
- Add required `ref` input to _build-binaries.yml and _build-packages.yml
- CI workflow passes `github.sha` (current commit)
- Release workflow passes `v{version}` (the new tag)
- All checkout steps now use the explicit ref

This ensures binaries are built from the correct commit with the updated
Cargo.toml version.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: bordeux

.github/workflows/_build-binaries.yml

@@ -9,6 +9,10 @@ permissions:
 on:
   workflow_call:
     inputs:
+      ref:
+        description: 'Git ref to checkout (commit SHA or tag)'
+        required: true
+        type: string
       upload-artifacts:
         description: 'Whether to upload artifacts'
         required: false
@@ -74,6 +78,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable

.github/workflows/_build-packages.yml

@@ -9,6 +9,10 @@ permissions:
 on:
   workflow_call:
     inputs:
+      ref:
+        description: 'Git ref to checkout (commit SHA or tag)'
+        required: true
+        type: string
       version:
         description: 'Version string for package naming (optional, reads from Cargo.toml if not provided)'
         required: false
@@ -47,6 +51,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -193,6 +199,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -266,6 +274,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable

.github/workflows/ci.yml

@@ -124,6 +124,7 @@ jobs:
     needs: [test, cargo-make]
     uses: ./.github/workflows/_build-binaries.yml
     with:
+      ref: ${{ github.sha }}
       upload-artifacts: true
       artifact-retention-days: 7
 
@@ -135,6 +136,7 @@ jobs:
     needs: [test, cargo-make]
     uses: ./.github/workflows/_build-packages.yml
     with:
+      ref: ${{ github.sha }}
       artifact-retention-days: 7
 
   # ============================================

.github/workflows/release.yml

@@ -74,6 +74,7 @@ jobs:
     if: needs.semantic-release.outputs.new_release_published == 'true'
     uses: ./.github/workflows/_build-binaries.yml
     with:
+      ref: v${{ needs.semantic-release.outputs.new_release_version }}
       upload-artifacts: true
       artifact-retention-days: 1
 
@@ -86,6 +87,7 @@ jobs:
     if: needs.semantic-release.outputs.new_release_published == 'true'
     uses: ./.github/workflows/_build-packages.yml
     with:
+      ref: v${{ needs.semantic-release.outputs.new_release_version }}
       version: ${{ needs.semantic-release.outputs.new_release_version }}
       artifact-retention-days: 1