fix(ci): build the exact bumped commit (not floating main) — kills the version race

The build checked out 'main', so concurrent pushes (each bumping the version) raced:
builds published mismatched/duplicate releases (v0.0.20 had partial binaries, v0.0.21
no DMG, etc.). The version job now outputs its commit SHA and the build checks that
out, so every release is internally consistent. Also re-triggers a build for the
notarization fix that didn't get one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 2 people

.github/workflows/release.yml

@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.bump.outputs.version }}
+      sha: ${{ steps.bump.outputs.sha }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -39,6 +40,10 @@ jobs:
           git add package.json package-lock.json
           git commit -m "chore: bump version to $VERSION [skip ci]"
           git push
+          # Pin the build to THIS exact commit, not floating main — otherwise a
+          # concurrent push's bump can advance main and the build publishes a
+          # mismatched/duplicate release (the version race that tangled v0.0.20/.21).
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
   # Build + publish per-OS natively (native modules + platform binaries differ).
   build:
@@ -53,7 +58,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: main # the just-bumped commit
+          ref: ${{ needs.version.outputs.sha }} # the exact bumped commit, not floating main
           fetch-depth: 0
           lfs: true # resources/bin/* (llama-server, sd-cli, whisper, ffmpeg, dylibs)
                     # are Git LFS — without this, CI bundles 131-byte pointer stubs