Fix canary release target_commitish on gh release calls

[d4rken]

Summary

• The first canary run on main failed at the final Update rolling canary pre-release step with HTTP 422 Release.target_commitish is invalid
• Cause: --target "$TAG" passed the literal string canary as target_commitish, which gh interprets as a branch name
• Switch gh release create to --target "$SHA" --verify-tag and drop --target from gh release edit since the canary tag is already moved to that commit by the preceding step

Current main state after the failed first run

• GHCR :canary and :sha-469e167 — published
• Git tag canary — points at 469e167
• GitHub release canary — not yet created (this PR's merge run will create it)

Test plan

• YAML parses
• Next push to main re-runs the workflow; gh release create should now succeed and create the rolling pre-release