fix(ci): drop --depth=1 from main fetch in release tag gate

The "Ensure tag commit is on main" step did `git fetch origin main
--depth=1` and then `git merge-base --is-ancestor $GITHUB_SHA
origin/main`. When the tagged commit is a parent of main's HEAD (release
fix-up commit followed by an unrelated commit on top — what just
happened with v0.6.2 + planning doc follow-up), the shallow fetch grafts
origin/main at its tip and the ancestor check returns false even though
the tag commit IS reachable via main's history. Up through v0.6.1 the
tag commit always equalled main HEAD, so the bug was masked.

Drop --depth=1; the checkout step already uses fetch-depth: 0, so a
full main fetch is cheap.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/upload-session-helper-gitea.yml

@@ -58,7 +58,12 @@ jobs:
       - name: Ensure tag commit is on main
         run: |
           set -eux
-          git fetch origin main --depth=1
+          # Full fetch (no --depth): when the tag commit is a parent of
+          # main's HEAD (release fix-up + follow-up commit on top), a
+          # shallow main fetch grafts at HEAD and `is-ancestor` returns
+          # false even though the tag commit is reachable. checkout step
+          # already used fetch-depth: 0, so a full fetch here is cheap.
+          git fetch origin main
           git merge-base --is-ancestor "$GITHUB_SHA" "origin/main"
 
       - name: Verify Cargo/Python versions match tag