scripts: allow tagging upstream release branches

[ziggie1984]

Summary

• make an explicit --branch select and tag the fetched upstream branch tip
• read build/version.go from the exact commit that will be tagged
• preserve the existing no-flag behavior, which verifies and tags the current HEAD
• fetch a fully qualified branch ref without implicitly fetching tags

Motivation

Older release branches do not contain scripts/tag-release.sh. Previously,
checking out such a branch made the helper unavailable, while passing
--branch from master only compared that branch with the current HEAD and
failed. The helper can now remain on master and safely tag the verified tip of
an older upstream release branch.

Validation

• bash -n scripts/tag-release.sh
• git diff --check
• exercised explicit --branch v0.20.x-branch with an intentionally mismatched
  tag and confirmed it read v0.20.3-beta.rc1 from the upstream branch without
  creating a tag
• exercised the original no-flag/current-HEAD path with an intentionally
  mismatched tag and confirmed version validation still rejects it

[github-actions]

🟢 PR Severity: LOW

file classification | 1 files | 85 lines changed

🟢 Low (1 files)

• scripts/tag-release.sh - build/release tooling script, not application code

Analysis

This PR only modifies scripts/tag-release.sh, a release tooling script. It does not touch any wallet, channel, HTLC, peer, or other consensus/fund-handling code paths, so it qualifies as best-effort review under the LOW severity tier. No severity bump conditions apply (single file, no critical packages touched).

---

_{To override, add a severity-override-{critical,high,medium,low} label.}