fix(release): fail on git errors in the latest-tag lookup and test it (#55)

[abienkowski]

Description

Part of #55 (Task 2 of the plan: tooling items from comments 4, 6 and 7). This PR does not close #55.

What changes

• Release latest-tag lookup (.github/workflows/release.yml:54). The old one-liner git tag … | grep … || true swallowed a git failure along with grep's no-match, so a broken checkout looked like "no tags" and the version would be computed from the whole history. It moves to scripts/release-latest-tag.sh [REF]:
  • git tag --list --merged REF --sort=-v:refname runs on its own under set -euo pipefail, so a git failure aborts.
  • Only grep's no-match is tolerated: no strict vX.Y.Z tag prints nothing and exits 0, as before.
• Tests: scripts/release-latest-tag_test.sh, wired into make test-release (already run by CI's release-scripts job). Cases: no-tags, strict-only, version-sort, ignores-prerelease, merged-only, explicit-ref (2 checks), git-failure, bad-ref (a REF that does not resolve, added after review). Throwaway repos ignore the user's and system git config.
• Docs: docs/release-versioning.md lists the new script and test.
• Small fixes: ROUTER_SPEC ?= in the Makefile, so it can be overridden like the other spec variables; the two duplicate GET /_ping -> 200 labels in deploy/test-sock.sh become (granted) and (default group).

Review notes

• Release: merging cuts v0.3.3 (patch). A simulated default squash message gives bump=patch tag=v0.3.3. No product behaviour changes.
• The release workflow uses the new script from this PR's own merge commit, so the v0.3.3 release itself exercises it.

Verification

• Test-first: before the script existed, the new test reported 0 passed, 8 failed.
• Mutation: restoring || true on the git tag line makes git-failure and bad-ref fail.
• make test-release: 51 passed, 0 failed (existing) and 9 passed, 0 failed (new); the new test also passes under macOS /bin/bash 3.2.
• shellcheck (scripts/*.sh), actionlint and make lint-all are clean.

Type of change

• Bug fix (release tooling)
• New feature
• Breaking change
• Documentation update

Implementation(s) changed

• Go
• Rust
• TypeScript
• Quint specification
• CI / infrastructure

Testing

• Unit tests pass (make test-all): not affected
• Integration tests pass: only two test-sock.sh labels change; CI runs the suites
• Quint verification: only the ROUTER_SPEC assignment changes; CI runs quint
• New tests added for the change (scripts/release-latest-tag_test.sh)

Checklist

• I have read CONTRIBUTING.md
• My code follows the project's coding style
• I have updated documentation as needed