Make suffix-free release tags updateable

[myobie]

A release tag such as v0.2.5 did not carry the build commit that every Fabric binary reports. The updater failed its ancestry check, then failed its staged-binary check.

This change resolves a suffix-free tag through the GitHub commits API. It builds the exact expected version from the package version and the tagged commit. Legacy tags that already carry a commit keep their exact behavior.

Red proof:

• The new suffix-free tag test failed before implementation because no commit-aware version mapping existed.

Verification:

• Locked library suite: 525 passed, 5 ignored.
• Locked update contract: 8 passed.
• The legacy v0.2.4+9b425d6 check still reports the installed newer build correctly.
• A live isolated dry run started from 0.2.4+382c6af and used --tag v0.2.5 without an override. It verified and accepted 0.2.5+4dc0cac. The old fixture remained unchanged.