Reject observed tag changes during shared module version reservation

Recheck the immediately preceding tag SHA after create-only reservation, including a tag first observed after preflight. Retain valid partial-claim completion without recreating a disappeared or replaced observed tag.

(cherry picked from commit 474d094)

Author: MariusStorhaug

.github/actions/Publish-PSModule/README.md

@@ -4,6 +4,8 @@ Publishes a pre-versioned, tested PowerShell module artifact to the PowerShell G
 
 The publisher verifies the original source, exact resolved tag/version, producing repository/PR or direct-release context, and tested bytes before an external versioned-artifact mutation. An absent Gallery module/version is reserved at `PSModule-Publication/<lowercase-module>/<lowercase-version>`, independently of the configured release-tag prefix. The shared coordinate and release tag reference the same immutable annotated source/context/file-tree/ZIP claim. Existing tags are never updated or deleted; the package ownership coordinate is retained for immutable Gallery proof.
 
+An observed release tag must remain unchanged through shared coordinate creation. If it disappears or is replaced during that reservation, the attempt fails instead of recreating it. A valid partial shared claim can still create an absent release tag that has never been observed in the attempt.
+
 An existing Gallery package is retained only when its raw nupkg payload matches that proof and the tested artifact. Package code is never imported to establish ownership. Unknown legacy proof, foreign tags/releases/assets, changed claims, authentication errors, and API failures stop publication explicitly.
 
 ## Inputs

.github/actions/Publish-PSModule/src/Publish-PSModule.Helpers.psm1

@@ -626,12 +626,16 @@ function New-PSModulePublicationTag {
     }
     if ($null -eq $current.VersionTagSha) {
         $versionTag = Get-PSModulePublicationVersionTag -ModuleName $Claim.ModuleName -GalleryVersion $Claim.GalleryVersion
+        $observedTagSha = $current.TagSha
         $reference = Invoke-PSModulePublicationApi -Endpoint "repos/$($Claim.Repository)/git/refs" `
             -Method POST -Field @{ ref = "refs/tags/$versionTag"; sha = $claimSha } -AllowConflict
         if ($reference.StatusCode -ne 201 -and $reference.Value.message -cne 'Reference already exists') {
             throw "Cannot atomically reserve module/version [$versionTag] (HTTP $($reference.StatusCode))."
         }
         $current = Get-PSModulePublicationState -ExpectedClaim $Claim -Reader $Reader
+        if ($null -ne $observedTagSha -and $current.TagSha -cne $observedTagSha) {
+            throw 'The existing publication tag changed or disappeared during the shared module/version claim. Refusing publication.'
+        }
         if ($null -eq $current.VersionTagSha -or
             ($reference.StatusCode -eq 201 -and $current.VersionTagSha -cne $claimSha)) {
             throw 'The module/version coordinate changed during its create-only claim. Refusing publication.'