ci: tag the release commit and push the appcast last

[itsjoshpark]

Makes the tag point at the release commit, so checking out vX.Y.Z builds the version it shipped as and includes its archived notes. Before, the tag pointed at the commit before the bump.

New order at the end of the 🚀 Release workflow:

1. Commit the release (new step): signs the dmg for Sparkle, appends the appcast item, writes the version to project.pbxproj, archives the notes, and commits all of it locally. Nothing is pushed yet.
2. Tag and create the GitHub release: tags that commit and publishes the release with the dmg and the archived notes.
3. Publish to the appcast and record the version: pushes the commit to main, retrying with a rebase.

Unlike PeekPreview (itsjoshpark/PeekPreview#11) and AudioBalance (itsjoshpark/AudioBalance#7), main is still pushed last here. The appcast links to releases/download/vX.Y.Z/…dmg. Pushing it before the release exists would offer Sparkle users a download that doesn't exist yet, and a broken update if the release step then failed.

Also:

• A rebase conflict in the push-retry loop now aborts the rebase with a clear error instead of dying mid-rebase.
• The loop no longer rebases after its last attempt.
• If the push to main fails, the error says how to recover by cherry-picking the tagged commit onto main.

If a rebase was needed, main gets a copy of the tagged commit with the same changes rather than the tagged commit itself.