fix(ci): test the exact ZUnit release tag

[ss-o]

Summary

• run the complete native ZUnit suite in the tag-triggered release job
• keep publication behind both the suite and the semantic tag/version guard
• protect the required command and ordering with a native contract test

Why

ADR-0009 requires the full functional suite to pass on the exact tag before a
release is published. The previous workflow built the tagged source and checked
its version, but did not execute the suite before publication.

Verification

• zsh build.zsh && ./zunit --tap tests (122 tests passed)
• actionlint .github/workflows/*.yml
• repository Zsh syntax command from .github/workflows/zsh-n.yml
• commit-time Trunk checks (2 modified files, no issues)
• git diff --check

Closes #20
Parent: z-shell/.github#556
Unblocks: z-shell/zsh-fancy-completions#62

[ss-o]

Agent handoff

Status: Ready for review
Repository: z-shell/zunit
Branch/PR: fix-20, #21
Tracker/Issue: #20, parent z-shell/.github#556

Current state

• PR head bc2905e66a61979b0cfec9896fba6d78e5157878 adds the exact-tag
  native-suite gate and protects its order before tag verification and
  publication.
• All hosted checks are green.
• z-shell/zsh-lint v1.2.0 is published from verified commit
  33bce8041faa1395455562c5a558a063ccdcc441.
• refactor!: adopt portable plugin contract v2 zsh-fancy-completions#62 still uses the older ZUnit pin and must not
  move to v0.8.2 until this PR is merged and the exact merged commit passes
  the tag-triggered release workflow.

Verification

• zsh build.zsh && ./zunit --tap tests: 122 tests passed.
• actionlint .github/workflows/*.yml: passed.
• repository Zsh syntax command: passed.
• commit-time Trunk checks: 2 modified files, no issues.
• hosted zunit, zsh-n, and Trunk Code Quality checks: passed.

Blockers

• Maintainer review and merge of fix(ci): test the exact ZUnit release tag #21. No merge was performed without separate
  merge authorization.

Next steps

1. Squash-merge fix(ci): test the exact ZUnit release tag #21 after review.
2. Fetch the merged main, verify the exact commit, create and publish the
   annotated v0.8.2 tag, and verify the release workflow and GitHub release.
3. Pin refactor!: adopt portable plugin contract v2 zsh-fancy-completions#62 to the released v1.2.0 and v0.8.2
   commit SHAs, push the plugin change, and watch all relevant checks settle.

[ss-o]

Agent handoff

Status: Complete
Repository: z-shell/zunit
Branch/PR: fix-20, #21
Tracker/Issue: #20, parent z-shell/.github#556

Current state

• PR fix(ci): test the exact ZUnit release tag #21 squash-merged through the active ruleset at
  15061c83373be80b523988121b7ba12c6b2d82dc.
• The tag-triggered release job now runs the full native suite before its
  tag/version guard and publication step.
• The required Zsh Lint workflow now runs on every main push and pull request;
  its contract test prevents a paths: filter from making the required check
  unavailable.
• Annotated tag and GitHub release v0.8.2 are published from the exact merge
  commit.

Verification

• exact merged commit: 123 native tests passed.
• Actionlint and repository Zsh syntax command: passed.
• merged main: all four hosted checks passed.
• release run 33222061230: build, native suite, tag guard, and publication
  passed.
• release asset zunit: SHA-256
  ce5b02eb45fb0b00f1ecb96ca3536f5c99eaaf202e67f9718863370627167453.

Blockers

• None.

Next steps

1. Consume commit 15061c83373be80b523988121b7ba12c6b2d82dc as the
   immutable v0.8.2 workflow pin where the lifecycle assertions are needed.