CI: prevent publishing a plugin version without its matching git tag

[jbragg]

Problem

A published plugin version can ship without its matching git tag, which breaks the SessionStart hook for every user on first startup.

Concretely: plugin asta-preview (and asta) was bumped to 0.18.0 in pyproject.toml + the marketplace manifest, but the v0.18.0 git tag was never pushed (latest was v0.17.2). The SessionStart hook runs hooks/sync-cli-version.sh, which does:

uv tool install --force "git+https://github.com/allenai/asta-plugins.git@v0.18.0"

With no v0.18.0 tag on the remote this fails:

Updating https://github.com/allenai/asta-plugins.git (v0.18.0)
error: Git operation failed
  Caused by: failed to fetch branch or tag `v0.18.0`
fatal: couldn't find remote ref refs/tags/v0.18.0

Claude Code surfaces this as a non-blocking SessionStart:startup hook error on every session start until the tag exists.

Contributing factors

• The 0.18.0 version bump rode in on feature PR Local vs. remote mode for auto-discovery #69 (40890a1) rather than a dedicated release commit, so it was easy to merge the version bump without cutting/pushing the tag.
• The v0.17.2 release line (1bdb498) is not an ancestor of main — the release history had diverged, making it easy to lose track of which version main actually represents.

Suggested fix

Add a CI check (PR + tag-push) that asserts a vX.Y.Z tag exists matching the version in pyproject.toml / the marketplace manifest before a version bump is considered released. Options:

• On PRs that change the manifest/pyproject.toml version, fail if the bumped version has no corresponding vX.Y.Z tag (or require the release to be cut atomically).
• Or automate tag creation on merge when the version field changes, so manifest version and git tag can never drift.

Workaround / immediate remediation

The missing v0.18.0 tag has already been pushed (pointing at 40890a1, the only commit where pyproject.toml declares 0.18.0), which resolves the live error. This issue tracks preventing recurrence.