Replace rolling canary release each run for immutable-release repos

[d4rken]

Summary

• This repo has GitHub's immutable-releases feature enabled, so gh release edit and asset --clobber upload are rejected after the first publish
• Tested directly: gh release delete and gh api DELETE refs/tags/canary both succeed against the immutable canary release
• Switch the workflow's two final steps to a single delete-then-create step that re-publishes the canary release on every run
• Also inlines a HEAD guard immediately before the delete-create window so a stale rerun cannot wipe a newer canary

Test plan

• YAML parses
• Next push to main produces a fresh canary GitHub release at the new SHA
• Subsequent push deletes that release/tag and creates a new one at the latest SHA