chore: guard release workflow version bumps

[dustinbyrne]

💡 Motivation and Context

The first failed release happened because package.json was introduced with stale release metadata (4.2.4) while the PHP SDK was already at 4.3.0. Changesets used package.json as the source of truth, calculated 4.3.0 as the next release, committed a version bump, and only then failed because the immutable 4.3.0 tag/release already existed.

The rerun for #142 calculated the correct 4.4.0 version, but failed while creating the signed version-bump commit via GitHub's createCommitOnBranch GraphQL mutation with a transient GitHub server error:

Something went wrong while executing your query

This hardens the release workflow against both failure modes:

• Validate package.json, composer.json, and lib/PostHog.php versions are in sync before applying changesets.
• After applying changesets, verify the calculated next version does not already have a tag or GitHub release before committing.
• Replace the third-party ghcommit-action wrapper with a small local createCommitOnBranch script that preserves GitHub-signed commits and retries transient GraphQL/server failures.
• Create the GitHub release against the exact version bump commit hash instead of the moving main ref.

💚 How did you test it?

Ran local checks for the new guards and commit script:

node --check scripts/create-github-signed-commit.mjs
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml")'
node scripts/create-github-signed-commit.mjs --repo PostHog/posthog-php --branch main --message "test commit" --dry-run
pnpm changeset status --verbose

Also simulated the release changes from current origin/main; dry-run detected the expected 4 additions/updates and 2 changeset deletions for the 4.4.0 release commit.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm changeset to generate a changeset file

[dustinbyrne]

Updated after checking the actual failed attempt: #142's release did calculate 4.4.0 correctly, but the signed commit step hit a transient GitHub GraphQL createCommitOnBranch server error. This PR now replaces the ghcommit wrapper with a local signed-commit script that retries those transient failures.