Publish from green CI instead of re-gating at the tag #49

The release workflow of guard-agent-ts should publish only commits whose push CI already passed, instead of re-gating at the tag. guard-core-rs v4.4.0 failed its release because release.yml re-ran lint and tests at the tag on a toolchain pull request CI never used, after the tag was already immutable, and a manual re-drive could not help because the tag check read GITHUB_REF_NAME. Mirroring Guard-Core/guard-core-rs#156: the release event and a workflow_dispatch with a required tag input both resolve the tag, a verify job checks the tag against the package version and requires green push CI on the tagged commit, and the publish job checks the tag out explicitly and skips anything already published, so a fixed master workflow can re-drive an existing tag safely.