Harden release workflow tag handling

[NateIsern]

Motivation

• Prevent shell command injection from untrusted tag names used in packaging steps by removing direct interpolation of ${{ github.ref_name }} inside shell run blocks.
• Ensure only well-formed release tags are accepted so CI artifacts and secrets cannot be exposed or tampered with by a crafted tag.

Description

• Modified .github/workflows/release.yml to pass github.ref_name into steps via an environment variable RELEASE_TAG instead of embedding it directly in run scripts.
• Added a strict validation check using a regex ^v[0-9]+[.][0-9]+[.][0-9]+(-[0-9A-Za-z][0-9A-Za-z.-]*)?$ at the start of each packaging step to reject malformed or malicious tag names.
• Replaced inline ${{ github.ref_name }} usages in packaging commands with quoted shell variables (e.g., PKG_DIR="faircoin-${RELEASE_TAG}-...") and quoted all generated paths and package-related variables.
• Applied these hardening changes across Linux tarball, Debian .deb, Windows ZIP, and macOS tarball packaging steps in release.yml.

Testing

• Ran a Python-based scan to verify no direct ${{ github.ref_name }} interpolation remains inside run blocks and the check passed.
• Executed git diff --check to validate whitespace and basic diff issues which succeeded with no warnings.
• Performed a bash -n style extraction/syntax check over the workflow run scripts to ensure the modified shell blocks are syntactically valid and the check passed.

---

Codex Task