ci: reject off-main Release Please tags

[f-trycua]

Summary

• fail closed before Release Please generates history when an existing manifest tag is not an ancestor of the checked-out target branch
• allow a missing manifest tag so a newly merged release PR can create it normally
• cover missing, ancestral, and divergent tag histories with focused Git-repository tests

Root cause

cua-driver-rs-v0.18.0 currently points to 726cbbfdc452b2696fed61eadcedffccae8f2c43, a release-metadata PR-head commit outside main. Its equivalent squash commit is on main, but Release Please matches exact SHAs. Release Please therefore could not find the 0.18 boundary while scanning main and included older Driver commits in #2912.

This PR does not modify #2912 or its release branch. It prevents another malformed update while the divergent 0.18 tag is current; after #2912 merges, the missing 0.19 tag remains an allowed state for Release Please to create.

Validation

• uv run --with pytest pytest -q .github/scripts/tests (158 passed, 6 subtests passed)
• uv run black --check .github/scripts/validate_release_please_tags.py .github/scripts/tests/test_validate_release_please_tags.py
• uv run ruff check .github/scripts/validate_release_please_tags.py .github/scripts/tests/test_validate_release_please_tags.py
• git diff --check
• live preflight reproduces the current off-main 0.18 tag failure