ci: refuse to release a version whose git tag already exists on origin

Same guard as the backend: the back-push step used `git tag ... || true`,
so an existing v<version> tag made it a silent no-op and left the version
pointing at an older commit. Checked before anything is built.

.gitea/workflows/ci.yml

@@ -128,6 +128,19 @@ jobs:
           echo "VERSION=${VERSION}"     >> "$GITHUB_ENV"
           echo "HARBOR_HOST=${HARBOR_HOST}, VERSION=${VERSION}, SHA_SHORT=${SHA_SHORT}"
 
+      - name: Refuse to reuse an existing version tag in git
+        run: |
+          set -u
+          # The back-push step below tags HEAD as v${VERSION}. If that tag is
+          # already on origin it points at an older commit, and `git tag`
+          # would fail silently, leaving the version attached to the wrong
+          # code. Harbor has its own guard next; this is the git half.
+          if git ls-remote --exit-code --tags origin "refs/tags/v${VERSION}" >/dev/null; then
+            echo "::error::Tag v${VERSION} already exists on origin. Bump package.json before merging."
+            exit 1
+          fi
+          echo "Tag v${VERSION} not yet on origin — proceeding."
+
       - name: Refuse to overwrite an existing version tag in Harbor
         env:
           HARBOR_USERNAME: ${{ secrets.MOVIELOOP_USERNAME }}
@@ -206,7 +219,9 @@ jobs:
           set -eu
           git config user.name  "gitea-actions[bot]"
           git config user.email "gitea-actions[bot]@tehriehldeal.com"
-          git tag "v${VERSION}" -m "${IMAGE_NAME} v${VERSION}" 2>/dev/null || true
+          # Guarded above: v${VERSION} was absent from origin when this run
+          # started, so creating it cannot silently no-op.
+          git tag "v${VERSION}" -m "${IMAGE_NAME} v${VERSION}"
           ORIGIN="$(git remote get-url origin | sed -E "s#https?://([^/]+)#https://${GITEA_TOKEN}@\1#")"
           # A failed tag push shouldn't undo a successful image push — log
           # and proceed so we don't poison subsequent retries.