fix(ci): unbreak hotfix-release semantic-release run (#1091)

The Checkout step used `ref: github.event.pull_request.head.sha`, which puts
git in detached HEAD. python-semantic-release v10.5.3 then bails with
"Detached HEAD state cannot match any release groups; no release will be made"
because it can't match the current branch against pyproject.toml's
`[tool.semantic_release].branch = "master"` config. The release silently
no-ops, no tag is cut, and the downstream build/addon-publish jobs are
skipped — which is what happened on the merge of #1090: stable was never
advanced past v7.4.0 and v7.4.1 was never built.

The original "avoid the merge commit" intent also caused a second latent bug:
the PR head SHA isn't on master's first-parent history, so the workflow's
later `git push origin HEAD:master` would have been non-fast-forward even
if semantic-release had worked.

Switch the checkout to `pull_request.merge_commit_sha` (the merge result
that's actually on master) and attach to a local `master` branch so
semantic-release matches its branch group. The downstream push then
fast-forwards as intended.

Co-authored-by: kingpanther13 <kingpanther13@users.noreply.github.com>

Author: kingpanther13

.github/workflows/hotfix-release.yml

@@ -28,14 +28,22 @@ jobs:
       issues: write
 
     steps:
-    - name: Checkout hotfix branch commit
+    - name: Checkout merged hotfix on master
       uses: actions/checkout@v6
       with:
-        # Checkout the original hotfix commit, not the merge commit
-        ref: ${{ github.event.pull_request.head.sha }}
+        # Check out the merge commit so the workspace matches master's history;
+        # then attach to a local master branch below. python-semantic-release
+        # matches the active branch against [tool.semantic_release].branch
+        # in pyproject.toml — a detached HEAD checkout (e.g., of head.sha)
+        # fails silently with "Detached HEAD state cannot match any release
+        # groups; no release will be made", which is what broke PR #1090.
+        ref: ${{ github.event.pull_request.merge_commit_sha }}
         fetch-depth: 0
         token: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Attach to master branch locally
+      run: git checkout -B master HEAD
+
     - name: Validate hotfix is based on stable
       run: |
         # Get the stable tag (moving tag that points to latest stable)