fix: release_prep.sh tag source, archive name, and MODULE.bazel version patching

[clappingmonkey]

What does this PR do?

Fixes three bugs in .github/workflows/release_prep.sh that caused the v0.2.0 release to produce a misnamed archive with a stale MODULE.bazel version.

Bug 1: Tag source (root cause of rules_odin-main.tar.gz)

Before: TAG="${TAG:-${GITHUB_REF_NAME:-}}" — reads from env var, which release_ruleset.yaml never sets. Falls back to GITHUB_REF_NAME = main (the branch).
After: TAG="${1:-}" — reads the positional argument that release_ruleset.yaml actually passes: .github/workflows/release_prep.sh ${{ inputs.tag_name || github.ref_name }}

Bug 2: Archive name missing v prefix

Before: rules_odin-0.2.0.tar.gz
After: rules_odin-v0.2.0.tar.gz — matches bazel-contrib convention and GitHub's source archive naming, so users can switch between released artifacts and source archives with identical strip_prefix.

Bug 3: MODULE.bazel version lag

Problem: smlx/ccv tags HEAD as-is. MODULE.bazel still says version = "0.1.0" when the tag is v0.2.0. BCR validation requires exact match (FAILED if not).
Fix: Extract git archive to tmpdir, sed patch version inside module() block only (not bazel_dep versions), verify the patch applied, re-archive.

Additional hardening (from @change-validator review)

• Reproducible archives: gzip -n strips gzip timestamp; GNU tar flags (--sort=name --mtime=@0 --owner=0 --group=0 --numeric-owner) used when available (CI on Ubuntu). Falls back gracefully on macOS.
• Patch validation: sed -n '/^module(/,/^)/p' | grep -q verifies the version was actually patched inside module(), not just anywhere in the file.
• Temp dir cleanup: trap 'rm -rf "${TMPDIR}"' EXIT ensures cleanup on all exit paths.
• Argument handling: TAG="${1:-}" under set -o nounset — graceful error instead of crash when no arg provided.

How was it tested?

• .github/workflows/release_prep.sh v0.2.0 locally:
  • Archive named rules_odin-v0.2.0.tar.gz ✅
  • Extracted MODULE.bazel has version = "0.2.0" in module() ✅
  • bazel_dep versions unchanged (1.7.1, 0.0.10) ✅
  • odin_version = "dev-2026-06" unchanged ✅
  • Release notes say version = "0.2.0" ✅
• .github/workflows/release_prep.sh with no arg → graceful error ✅
• pre-commit run --all-files — all 10 hooks pass ✅
• bazel build //... — no regressions ✅
• @change-validator — APPROVE WITH CONCERNS (1 concern: grep scope → fixed)

Checklist

• PR title follows conventional commit format
• CI passes (check.yaml — lint + test matrix)
• No tests needed (shell script fix, verified locally)
• No breaking changes (fixes existing broken behavior)