#skip-changelog

## Summary
- Resolve a SHA-pinned action ref using the version in that action
checkout as a candidate, then verify its exact Git tag points at the
action commit and its GitHub release is published with an uploaded
`craft` binary. The version in `package.json` alone never proves
publication.
- Use two direct GitHub API lookups rather than paginating every tag and
release. Resolve abbreviated commit refs with a third API call; accept
full 40-character SHAs and future 64-character SHAs.
- Preserve explicit `craft_version` overrides, moving major-tag
handling, ordinary release refs, and fail-closed behavior for missing or
mismatched tags/releases/binaries.

## Validation
- Live GitHub API: the failed sentry-php action SHA
`7fe142107c12ea31eaaba10e4985674490bf808b` has package version `2.33.1`;
tag `2.33.1` points at that SHA and its published release has an
uploaded `craft` asset. The shortened `7fe1421` resolves to that full
commit.
- Focused: 54 action tests passed. Full suite: 62 files passed, 1,259
tests passed, 1 skipped (before the final refinement of the API-failure
test, which passed in the focused run).
- Typecheck, production build, and Prettier passed. ESLint passed with
seven existing unused-variable warnings in `publish.ts` and `git.ts`.

The sentry-php workflow uses `getsentry/craft@v2`. A release must
advance `v2` to this fix before that workflow benefits.