feat(github): support git tags as deployment and update triggers

[chbndrhnns]

Summary

Enables Git tags (and wildcard tag patterns such as refs/tags/*, tags/*, v*) as deployment and update triggers for Git-backed projects (including Docker Compose stacks like Noodle Gallery).

Closes #717

Changes

1. GitHub Push Webhook Handling (apps/api/src/modules/github/webhook-push.ts):

   • Accepted refs/tags/* in addition to refs/heads/* pushes.
   • Updated projectWebhookMatches to support:
     • Exact tag names (e.g. gitBranch: "v1.2.3").
     • Full tag refs (gitBranch: "refs/tags/v1.2.3").
     • Prefix / wildcard patterns (refs/tags/*, tags/*, v*, *).
     • Branch wildcard patterns (e.g. release/*).
   • Ensured forceAll: true on tag pushes so multi-service projects rebuild without being skipped when the tag references existing commits.
   • Forwarded tag triggers and commit SHAs to Cloud projects.

2. Tag Discovery & Resolution (apps/api/src/modules/github/github.service.ts):

   • Added listTags and resolveLatestMatchingTagCommit to discover and sort matching tags by semver descending.
   • Added GitHubTag interface in github.types.ts.

3. Drift Evaluation & Deployments (apps/api):

   • Updated resolveUpstreamDrift in project-crud.service.ts to resolve tag patterns when evaluating upstream drift.
   • Updated resolveProjectBranch and resolveLatestCommitInfo in build.service.ts to resolve concrete tag names and commit info when deploying projects configured with tag patterns.
   • Updated environment creation validation in project-crud.service.ts to allow tag patterns and existing tag refs.

4. Wildcard Matcher (packages/core):

   • Added matchesWildcard utility in @repo/core to handle case-insensitive glob-style matching (*).

Testing

• Added unit tests in packages/core/test/matches-wildcard.test.ts for wildcard matching.
• Added comprehensive unit tests in apps/api/test/modules/github/webhook-tag-push.test.ts for tag/branch webhook matching, tag deployment triggering, and tag resolution.