Add fail-loudly guard to release job once github.ref-on-release-event behavior is confirmed resolved

[adrianhall]

Background

Follow-up to #495 (recommendation #3 in that issue), deferred from the fix PR.

#495's recommended fix included a guard step in the release job that asserts github.ref_name == github.event.release.tag_name and fails loudly (::error:: + non-zero exit) if they don't match, rather than silently skipping.

Why this was deferred

The fix landed in #495 addresses the actual root causes without depending on github.ref/github.ref_name at all:

1. sign/release job if: conditions are now gated on github.event_name instead of string-matching github.ref.
2. The package version is now computed from github.event.release.tag_name directly for release events instead of $env:GITHUB_REF.

However, the observed bug in #495 was that github.ref/$env:GITHUB_REF was empty on release: published events for this repo (confirmed byte-for-byte in run logs for both the 10.1.0 and 10.1.1 releases). If that emptiness is a persistent platform/org-policy behavior rather than a one-off glitch, then a guard that hard-fails whenever github.ref_name != github.event.release.tag_name would fail on every future release — even though the real skip/version bugs are already fixed — because an empty ref_name will never equal a real tag name. That would turn a now-working pipeline back into a permanently red one.

What to do

Once it's confirmed (e.g. after a test release such as 10.1.2) whether github.ref/github.ref_name reliably resolves on release events again:

• If it resolves correctly again: add the guard step as originally proposed in release event triggers with an empty github.ref, silently skipping sign/release jobs (broke 10.1.0 and 10.1.1 publishing) #495:

  - name: Verify release ref matches published tag
    if: ${{ github.event_name == 'release' }}
    run: |
      if [ "${{ github.ref_name }}" != "${{ github.event.release.tag_name }}" ]; then
        echo "::error::github.ref_name ('${{ github.ref_name }}') does not match github.event.release.tag_name ('${{ github.event.release.tag_name }}')"
        exit 1
      fi
    shell: bash

  in the release job of both build-library.yml and build-template.yml, before the existing steps.
• If it's still empty/unreliable: reconsider the guard's design (e.g. only warn, or compare against something else that doesn't depend on ref resolution) rather than hard-failing on every release.

References

• release event triggers with an empty github.ref, silently skipping sign/release jobs (broke 10.1.0 and 10.1.1 publishing) #495 (original issue and root cause analysis)
• Run 28783150142 (10.1.1 release, empty $GITHUB_REF confirmed in logs)
• Run 27936434216 (10.1.0 release, same bug)