ci: build the source the version names

A manual run takes the version as an input but the checkout had no ref, so it
built whatever the run was dispatched from. Dispatching off main to rebuild an
older release would have published current main under that release's tags, and
moved `latest` to it.

Check out the version instead, falling back to the run's own ref when there is
no version, which is the push that publishes `develop`. The release and call
paths already checked out the right commit; this makes them explicit and fails
loudly on a version with no tag rather than mislabelling an image. The compose
file attached to the release now comes from the tag too.

.github/workflows/ci.yml

@@ -65,6 +65,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx
@@ -190,6 +195,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Attach the standalone compose file to the release

.github/workflows/cife.yml

@@ -68,6 +68,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx

.github/workflows/sandbox-image.yml

@@ -80,6 +80,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          # Build the source the tag names, not whatever the run was started
+          # from: a manual run dispatched off main would otherwise publish the
+          # current branch under an older version's tags. Empty for a push,
+          # where the checked-out commit is the one being tagged `develop`.
+          ref: ${{ inputs.version || github.ref }}
           persist-credentials: false
 
       - name: Set up Docker Buildx