GeezerVison

Summary

• Move the tag job to run after build succeeds, so a failed build no longer leaves a dangling tag behind. All publish jobs (github-release, cargo-publish, npm-publish, pypi-publish) now depend on tag, so we never half-publish without one.
• Replace dtolnay/rust-toolchain with direct rustup show + rustup target add. The dtolnay action can't auto-detect the channel when pinned by SHA (it normally parses it from the ref name like @stable), which caused the release run to fail with 'toolchain' is a required input. This matches the pattern already used in ci.yml.

Test plan

• Trigger the Release workflow with dry-run: true and confirm all matrix targets build successfully
• Confirm no v* tag is created on a dry-run
• On a real release, confirm the tag is created only after all builds pass, and publish jobs run after the tag

🤖 Generated with Claude Code