fix: tag the final release commit after syncing lockfiles (#4825)

Release tags currently point to the version bump before the lockfile
amend, so tagged CLI builds fail with `--locked` even though the branch
has the synced lockfile.

Keep the newly created, unpublished tag on the final amended release
commit before pushing. Existing published tags and packages remain
unchanged.

[Remote preview dry
run](https://github.com/lancedb/lancedb/actions/runs/41764901500) passed
and moved the local tag after the lockfile amend; no tag was pushed.

.github/workflows/make-release-commit.yml

@@ -62,7 +62,12 @@ jobs:
         run: |
           pip install bump-my-version PyGithub packaging
           bash ci/bump_version.sh ${{ inputs.type }} ${{ inputs.bump-minor }}
+          release_tag=$(git describe --tags --exact-match HEAD)
           bash ci/update_lockfiles.sh --amend
+          # Keep the unpublished tag on the commit that includes the synced lockfile.
+          if [ "$(git rev-parse "${release_tag}^{}")" != "$(git rev-parse HEAD)" ]; then
+            git tag --force --annotate "$release_tag" --message "$(git log -1 --format=%s)" HEAD
+          fi
       - name: Push new version tag
         if: ${{ !inputs.dry_run }}
         uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0