fix(upsert-release): target the triggering commit when creating a release

[taorepoara]

Summary

• gh release create in upsert-release.yml ran without a prior checkout and without --target, so GitHub created the new tag pointing at whatever commit was HEAD of the repo's default branch at that moment, instead of the commit that actually triggered the calling workflow.
• Observed in lenra-io/app-reveel: five consecutive prerelease tags (v1.7.0-beta.60 through v1.7.0-beta.64), created for five different beta-branch commits, all ended up pointing at the same stale commit on main — because main hadn't moved in that window.
• The actual build/deploy steps still use the correct checked-out source for each run, so shipped artifacts were unaffected — this only broke the tag/release-to-commit traceability in GitHub.
• Fix: pass --target ${{ github.sha }} to gh release create. In a reusable workflow invoked via uses:, github.sha resolves to the caller's triggering commit, so the tag now lands on the correct commit regardless of which branch called it.

Test plan

• On the next release created through this workflow (e.g. from app-reveel), verify the new tag's commit matches the workflow run's actual triggering commit.

---

Generated by Claude Code