Fix release version inputs and nightly tag validation

[IchenDEV]

Outcome

Fixes the release-input failure in nightly run 36334044094. Nightly now supplies version=0.0.47 and tag=v0.0.47; the manual tag entry point also passes its resolved numeric version. New nightly tags use the existing main-tip validation before creation instead of requiring the tag to exist first.

SDLC bundle and risk

• Bundle: release-input-contract
• Risk: high — release automation.
• Intent, design, implementation plan, and local verification explicitly approved by chenli.
• Human decisions still required: PR approval and protected production approval.

Verification

See verification evidence.

• bash scripts/sdlc-checks.sh
• bash scripts/ci-basic-checks.sh
• swift test: 793 XCTest cases, 18 conditional skips, zero failures; one Swift Testing case passed.
• bash scripts/build-app.sh --app-only --sign=-: app build and artifact verification passed.
• New executable workflow contract test failed nine assertions before the fix and passed afterward.
• Independent read-only review and rerun of release regression suites: no actionable findings.
• Remote CI run 36378897867: Contract & Tests, Release-style App Build, and SDLC Gate all passed.
• UI and permission QA: not applicable; no application behavior changed.

Residual risk and rollback

Fixtures intercept push and do not exercise production signing, notarization, GitHub expression evaluation, or a concurrent remote push race. Existing production, signing, and immutable-asset controls are unchanged. Remote CI passed for head 490b075; GitHub reports no merge conflicts. Revert the scoped workflow/test changes if needed; preserve existing tags and published assets.

Reviewer focus

Check both callers' step-to-job-to-input version wiring and the require_ancestor && !create_tag condition. The nightly create path retains main-tip equality, existing-tag refusal, and non-force push.