fix(release): tolerate executable-bit flips in tag-script status checks

The auto-tag workflow failed on the first run after flowglad-main got the
fix for the empty-ArrayBuffer dbBuffer regression:

  Error: Validation changed files. Commit the build output first, then rerun:
   M packages/just-bash/dist/bin/just-bash.js
   M packages/just-bash/dist/bin/shell/shell.js

esbuild emits dist/bin/*.js at mode 100644 on Linux, but those files were
originally committed at mode 100755 and the create-flowglad-package-tag.mjs
status checks could not tell the difference between an executable-bit flip
(spurious) and a real content change (a legitimately uncommitted dist).

Two-part fix:

- Pass `-c core.fileMode=false` to the pre-validation and post-validation
  `git status --porcelain` calls so the script ignores executable-bit
  diffs between index and working tree. Real content drift still aborts
  the run.
- Chmod the committed `dist/bin/just-bash.js` and
  `dist/bin/shell/shell.js` index entries from 100755 to 100644, matching
  what esbuild produces. The blob hashes are unchanged. npm/Bun set the
  executable bit at install time via the package.json `bin` field, so
  consumers are unaffected.

After this, an auto-tag run on a flowglad-main HEAD whose dist matches a
clean rebuild will pass; an auto-tag run on a HEAD with stale dist will
still abort with the existing error message.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: subsetpark

packages/just-bash/dist/bin/just-bash.js

@@ -91,7 +91,16 @@ if (currentBranch !== branch) {
   );
 }
 
-const status = run("git", ["status", "--porcelain"], { capture: true });
+// `-c core.fileMode=false` so executable-bit flips don't show up here. esbuild
+// emits dist/bin/*.js at mode 100644 on Linux, but those files were originally
+// committed at 100755 (and macOS preserves that on rebuild), so a CI rebuild
+// would otherwise look like a "dirty worktree" or "validation changed files"
+// even when no content changed.
+const status = run(
+  "git",
+  ["-c", "core.fileMode=false", "status", "--porcelain"],
+  { capture: true },
+);
 if (status) {
   throw new Error(`Refusing to release with a dirty worktree:\n${status}`);
 }
@@ -143,9 +152,11 @@ if (!skipValidation) {
     "src/commands/python3/python3.optin.test.ts",
   ]);
 
-  const postValidationStatus = run("git", ["status", "--porcelain"], {
-    capture: true,
-  });
+  const postValidationStatus = run(
+    "git",
+    ["-c", "core.fileMode=false", "status", "--porcelain"],
+    { capture: true },
+  );
   if (postValidationStatus) {
     throw new Error(
       `Validation changed files. Commit the build output first, then rerun:\n${postValidationStatus}`,