[REL]: Add a workflow to tag a release

[mdboom]

This is a suggested solution to workaround the issue we ran into with the recent cuda_pathfinder release.

(Initial revision created with Claude -- be extra cautious about its errors).

This adds a tag to the repo by first creating a new empty commit and then tagging that. This will force CI to rerun with a tagged commit and create wheels and tarballs that have a proper tagged version, which then should be handled correctly when the CI: Release workflow is used to upload to PyPI etc.

This also acts as a starting point to put more automation steps for things we want to do when we tag a release.

An important downside of this approach is that you can't specify a specific commit to tag for release -- it needs to be the tip of main right now. (Because we need to create a new commit, and we need to put the new commit somewhere). This is a subtle "race condition" because things could be merged during the moment the user is trying to tag a release. I thought I would put this up to create some discussion around this. One nice solution would be to create a branch, then create the new commit and tag on that branch, which leaves a nice branch around to create bug fix releases from in the future. But that would no longer put tags on main as we currently do.

This also updates the CI: Release task so it takes a component and a version, rather than a git tag, to be inline with this new workflow and reduce the ability to create an invalid tag. I thought having these two workflows be different would cause a lot of confusion.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[mdboom]

Test run of this on my own fork here: https://github.com/mdboom/cuda-python/actions/runs/21956196329/job/63420782798

[rwgk]

Hm, did you see the PR #1606 that I posted yesterday (Cursor-generated)?

That adds a tag-push-trigger, so we don't need an empty commit.

Do we want an empty commit?

(Note that #1606 also adds extra safety, ci/tools/validate-release-wheels; without that it'd just be a small surgical PR.)

[rwgk]

An important downside of this approach is that you can't specify a specific commit to tag for release -- it needs to be the tip of main right now.

The tag-push-trigger approach doesn't have that downside. According to what Cursor explained to me, we can even tag cuda-pathfinder, cuda-bindings, cuda-core concurrently and it'll all work.

[mdboom]

Sorry, @rwgk, I didn't see #1606. Let me look...