DEVOPS-1131: Use ref_name and add release tag validation in python_deploy_prod.yml

[RomFloreani]

DEVOPS-1131 - python_deploy_prod workflow to use tag from revision: no manual input
Use github.ref_name instead of workflow_dispatch input release-tag, and add a validate-release-tag job to fail fast when the workflow is not run from a tag.

Mirrors the change made in MiraGeoscience/simpeg#167.

[Copilot]

Pull request overview

Updates the production Python deployment workflow to derive the release tag from the GitHub ref context (rather than a manual input) and to fail fast when a manual run isn’t executed from a tag. This aligns the workflow behavior with tag-based releases and reduces the chance of publishing from an incorrect ref.

Changes:

• Removed the workflow_dispatchrelease-tag input and switched consumers to ${{ github.ref_name }} (with release events still using ${{ github.event.release.tag_name }}).
• Added a validate-release-tag guard job and wired downstream publish jobs to needs: validate-release-tag.
• Updated concurrency grouping to key off the release tag / ref name instead of the removed input.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.