fix(release): verify tags in mounted workspaces

tools/release/govoplan_release/version_alignment.py

@@ -681,10 +681,22 @@ def _git_lock_resolution_issues(
 
 
 def _git_tag_commit(repo_path: Path, tag: str) -> str | None:
+    repo_path = repo_path.resolve()
     if not (repo_path / ".git").exists():
         return None
     result = subprocess.run(
-        ["/usr/bin/git", "-C", str(repo_path), "rev-list", "-n", "1", tag],
+        [
+            "/usr/bin/git",
+            "-c",
+            "core.hooksPath=/dev/null",
+            "-c",
+            f"safe.directory={repo_path}",
+            "-C",
+            str(repo_path),
+            "rev-parse",
+            "--verify",
+            f"refs/tags/{tag}^{{commit}}",
+        ],
         check=False,
         text=True,
         stdout=subprocess.PIPE,
@@ -697,10 +709,22 @@ def _git_tag_commit(repo_path: Path, tag: str) -> str | None:
 
 
 def _git_tag_file(repo_path: Path, tag: str, relative_path: str) -> str | None:
+    repo_path = repo_path.resolve()
     if not (repo_path / ".git").exists():
         return None
     result = subprocess.run(
-        ["/usr/bin/git", "-C", str(repo_path), "show", f"{tag}:{relative_path}"],
+        [
+            "/usr/bin/git",
+            "-c",
+            "core.hooksPath=/dev/null",
+            "-c",
+            f"safe.directory={repo_path}",
+            "-C",
+            str(repo_path),
+            "cat-file",
+            "blob",
+            f"refs/tags/{tag}^{{commit}}:{relative_path}",
+        ],
         check=False,
         text=True,
         stdout=subprocess.PIPE,