Support full-tag prepared CI delivery

internal/git/prepare.go

@@ -29,12 +29,30 @@ func PrepareTaggedCheckout(ctx context.Context, repositoryDir, tag, remote, expe
 	if _, err := run(ctx, repositoryDir, nil, "checkout", "--detach", source.TagCommit); err != nil {
 		return fmt.Errorf("check out tag %s at %s: %w", tag, source.TagCommit, err)
 	}
-	head, err := run(ctx, repositoryDir, nil, "rev-parse", "--verify", "HEAD^{commit}")
-	if err != nil {
-		return fmt.Errorf("verify prepared checkout HEAD: %w", err)
+	return VerifyTaggedCheckout(ctx, repositoryDir, tag, expectedCommit)
+}
+
+// VerifyTaggedCheckout confirms that the existing local tag, HEAD, and clean
+// worktree all identify the expected commit. It does not fetch or check out.
+func VerifyTaggedCheckout(ctx context.Context, repositoryDir, tag, expectedCommit string) error {
+	if err := checkTagRef(ctx, repositoryDir, tag); err != nil {
+		return err
 	}
-	if !strings.EqualFold(strings.TrimSpace(head), expectedCommit) {
-		return fmt.Errorf("prepared checkout HEAD is %s, expected %s", strings.TrimSpace(head), expectedCommit)
+	if !validObjectID(expectedCommit) {
+		return fmt.Errorf("invalid tagged checkout commit %q for tag %q", expectedCommit, tag)
+	}
+	source, err := InspectTaggedSource(ctx, repositoryDir, tag)
+	if err != nil {
+		return err
+	}
+	if source.Status != "" {
+		return fmt.Errorf("tagged checkout must be clean:\n%s", source.Status)
+	}
+	if !strings.EqualFold(source.TagCommit, expectedCommit) {
+		return fmt.Errorf("tag %s resolves to commit %s, expected %s", tag, source.TagCommit, expectedCommit)
+	}
+	if !strings.EqualFold(source.Head, expectedCommit) {
+		return fmt.Errorf("checkout HEAD is %s, expected %s", source.Head, expectedCommit)
 	}
 	return nil
 }