ci: backport update-version-tags hardening to sagitta (rolls up #1953 + #1958)

Brings sagitta's `.github/workflows/update-version-tags.yml` to the
final post-#1958 rolling-side state. This rolls up the entire
hardening series in one shot because Mergify's per-PR backport could
not cherry-pick #1958 cleanly onto a base that never received #1953
(the prior backport, #1955, was closed).

Final workflow shape:

- Two-job pipeline. `check_head` resolves the per-branch tag name and
  filters stale "Re-run jobs" replays via a HEAD-equivalence check
  against the live branch HEAD; sets `is_current` output.
- `retag` depends on `check_head`, runs only when `is_current=='true'`,
  carries job-level `concurrency: {group: version-tag-<ref>,
  cancel-in-progress: false}` so back-to-back pushes serialize in
  commit order.
- `retag` re-validates HEAD inside its own job before PATCH so that
  GitHub's "Re-run failed jobs" (which can re-execute retag in
  isolation) cannot move the tag to a stale `github.sha`.
- Tag mutation: PATCH-first, fallback to POST only on HTTP 404, fail
  loud on any other gh-api error.

Verbatim copy of `origin/rolling:.github/workflows/update-version-tags.yml`
substantive content, with the LTS branch's "keep all three copies in
sync" header preserved (rolling has a context7-refresh-specific header
because that workflow is rolling-only).

🤖 Generated by [robots](https://vyos.io)

0 files changed, 0 insertions, 0 deletions