Update cibuildwheel.yml to use release-v* tag semantics

Align with thinc's workflow: trigger only on release-v*/prerelease-v*
tags instead of branch pushes/PRs, pin the reusable workflow to a
specific SHA, remove the now-unnecessary create-release input, and add
the retag_release job that re-points the draft release to a clean v* tag.

Author: honnibal

.github/workflows/cibuildwheel.yml

@@ -1,27 +1,56 @@
-name: Build wheels
+name: Build
 
-on:
-  push:
-    branches: [master]
-  pull_request:
-    branches: ["*"]
-  workflow_dispatch: # allows you to trigger manually
-
-# When this workflow is queued, automatically cancel any previous running
-# or pending jobs from the same branch
 concurrency:
-  group: Build-${{ github.ref }}
+  group: ${{ github.workflow }}
   cancel-in-progress: true
 
+on:
+  push:
+    tags:
+      # ytf did they invent their own syntax that's almost regex?
+      # ** matches 'zero or more of any character'
+      - 'release-v[0-9]+.[0-9]+.[0-9]+**'
+      - 'prerelease-v[0-9]+.[0-9]+.[0-9]+**'
 jobs:
   build_wheels:
-    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@main
+    uses: explosion/gha-cibuildwheel/.github/workflows/cibuildwheel.yml@2c98f757f13d112cf73fcf4b627249f1fffb5aae # main
     permissions:
       contents: write
       actions: read
     with:
       wheel-name-pattern: "srsly-*.whl"
       pure-python: true
-      create-release: ${{ startsWith(github.ref, 'refs/tags/release-') || startsWith(github.ref, 'refs/tags/prerelease-') }}
     secrets:
       gh-token: ${{ secrets.GITHUB_TOKEN }}
+
+  retag_release:
+    needs: build_wheels
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - name: Retag release from release-v* to v*
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Strip release- or prerelease- prefix to get the v* tag
+          TRIGGER_TAG="${GITHUB_REF_NAME}"
+          if [[ "$TRIGGER_TAG" == release-* ]]; then
+            VERSION_TAG="${TRIGGER_TAG#release-}"
+          elif [[ "$TRIGGER_TAG" == prerelease-* ]]; then
+            VERSION_TAG="${TRIGGER_TAG#prerelease-}"
+          else
+            echo "Unexpected tag format: $TRIGGER_TAG"
+            exit 1
+          fi
+
+          # Create the v* tag on the same commit
+          git tag "$VERSION_TAG" "$GITHUB_SHA"
+          git push origin "$VERSION_TAG"
+
+          # Re-point the draft release to the v* tag
+          gh release edit "$TRIGGER_TAG" --tag "$VERSION_TAG"
+
+          # Delete the trigger tag
+          git push origin --delete "$TRIGGER_TAG"