fix: use tag-based versioning to work with branch protection

[wardbryan3]

Problem

CI fails on push to main with:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Cannot update this protected ref.
remote: - Changes must be made through a pull request.

The main branch is now protected. The workflow was committing a version bump and running git push origin main --tags, which is rejected.

Fix

Switch to tag-based versioning — no push to main at all:

• Version source: reads the latest git tag (git tag --sort=-creatordate) instead of __init__.py, so the version always advances correctly across runs
• No push to main: the version bump commit is created in detached HEAD, tagged, and only the tag is pushed (git push origin <tag>). Main is never touched.
• Duplicate tag guard: checks if the tag already exists before creating it (handles re-runs)
• Build job: checks out the tag ref, which includes the updated __init__.py in the tagged commit

Test Plan

• Merge this PR and verify the next push to main triggers CI that completes without the branch protection error
• Verify a new tag and GitHub Release are created