Require a verified tag collection for source claim discovery

Keep verified empty collections valid and reject projected scalar metadata before source-bound recovery selection.

(cherry picked from commit ae7c333)

Author: MariusStorhaug

.github/actions/Publish-PSModule/src/Publish-PSModule.Helpers.psm1

@@ -338,7 +338,11 @@ function Get-PSModulePublicationReader {
         }.GetNewClosure()
         GetTagReference          = $readTagReference
         GetTagList               = {
-            (Invoke-PSModulePublicationApi -Endpoint "repos/$Repository/git/matching-refs/tags/").Value
+            $value = (Invoke-PSModulePublicationApi -Endpoint "repos/$Repository/git/matching-refs/tags/").Value
+            if ($value -isnot [array]) {
+                throw 'The publication tag enumeration returned unverifiable collection metadata.'
+            }
+            $value
         }.GetNewClosure()
         GetVersionReference      = {
             param($Name, $Version)

.github/actions/Publish-PSModule/tests/Publish-PSModule.Preflight.Tests.ps1

@@ -245,7 +245,7 @@ Describe 'Publish-PSModule source-bound preflight' {
 
     It 'rejects a scalar tag enumeration instead of projecting a discovery collection' {
         $script:state.ApiResponses['repos/PSModule/TestModule/git/matching-refs/tags/'] = [pscustomobject]@{
-            ref = 'refs/tags/v1.2.4'
+            ref    = 'refs/tags/v1.2.4'
             object = [pscustomobject]@{ type = 'commit'; sha = $env:GITHUB_SHA }
         }
         $reader = Get-PSModulePublicationReader -Repository 'PSModule/TestModule' -ReadOnly