Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

ci: address Copilot review on release workflow

- Drop the unused GOFLAGS env from the release job (this workflow never
  compiles Mercure code; build tags belong to ci.yml/cd.yml).
- Validate the version input inside the workflow as well, so a
  UI-triggered dispatch can't slip a non-semver string through.
- Pin helm-docs to v1.14.2 instead of @latest for reproducibility.
- Replace fragile "(HTTP 404)" stderr grepping with a matching-refs
  lookup that returns an empty array for absent tags, and extend the
  split-state guard so a mismatched caddy/v<version> on the resume
  path is caught up-front instead of inside create_tag.
- Build the release tree from `git diff --name-only HEAD` so any file
  the bump or helm-docs touches (e.g. an unexpected top-level go.sum
  delta) is captured, matching the previous `git commit -a` behavior.
- On resume, skip the cd.yml dispatch when a prior run is already in
  flight or has succeeded; only failed runs are retried.
- Restore the three-way behind/ahead/diverged diagnostic in release.sh
  that the rewrite collapsed into a single equality check.