fix(ci): fetch release tags where the range base reads them (#703)

Review r1 (High): actions/checkout passes `git fetch --no-tags` unless
`fetch-tags: true`, even with fetch-depth 0, so releaseTaggedShas() was always
empty in CI and a candidate outside the 100-run API window fell back to
event.before instead of the last release tag. Preflight and changes now fetch
tags; the workflow contract pins the option. The AC2 dev-push case now uses its
own input (dev runs only, an older `before`) instead of repeating the main call
(review r1, Low).

Issue: #703
User-Visible: no
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018qZfe7YS4rqEMKoVeS3GKd

test/validate-workflow.test.mjs

@@ -372,8 +372,12 @@ test('#703 AC3: на пуше в main база диапазона видит п
   assert.match(range, /other=dev; \[ "\$BRANCH" = "dev" \] && other=main/);
   assert.match(range, /-f branch="\$other" -f status=completed/);
   assert.match(range, /--runs=\/tmp\/validate-runs\.json --runs=\/tmp\/validate-runs-other\.json/);
-  // Теги релиза читаются из истории: обе job клонируют её целиком.
-  for (const job of [preflight, changes]) assert.match(job, /fetch-depth: 0/);
+  // Теги релиза — граница материала. `actions/checkout` по умолчанию качает с
+  // `--no-tags` даже при `fetch-depth: 0` (r1 ревью #703): без `fetch-tags`
+  // `releaseTaggedShas()` в CI всегда пуст.
+  for (const job of [preflight, changes]) {
+    assert.match(job, /with: \{ fetch-depth: 0, filter: 'blob:none', fetch-tags: true \}/);
+  }
 });
 
 /** Ставит ли workflow python-зависимости — по собственному содержимому.