orb-beta-release.yml: dispatch race between tag-push and release-build dispatch

[JSONbored]

What happened

orb-beta-release.yml's "Dispatch the ORB release build" step fires release-selfhost.yml via
gh workflow run release-selfhost.yml --ref main ... — dispatching against the floating main branch
rather than the beta tag it had just created and pushed one step earlier in the same job.

Observed live: tag orb-v0.4.0-beta.21 was pushed pointing at commit 347ada8ec (PR #4675's merge). By
the time the dispatch fired, PR #4676 had already merged, moving main to e984eef7c. The dispatched
release-selfhost.yml run resolved github.sha to e984eef7c (from --ref main), while the tag it was
supposed to release still pointed at 347ada8ec — tripping release-selfhost.yml's own
TAG_SHA-must-equal-RELEASE_SHA fail-safe check and aborting with "automated beta releases must
dispatch the tag that was just created for this commit."

Impact: the fail-safe worked correctly (no bad image was built/published), but the scheduled beta
release for that day was skipped. Exposed by unusually rapid merge velocity (several PRs landing within
a minute of each other), but the race exists any time even one commit lands between the tag-push step and
the dispatch step — narrow window, but non-zero on any actively-developed repo.

Fix

Dispatch against the tag (--ref "$TAG") instead of main. The tag is immutable once pushed, so
github.sha inside the dispatched run resolves to exactly the commit the tag points to, by construction
— the race window closes entirely regardless of how many commits land on main afterward.

Verification

.github/workflows/*.yml isn't unit-testable in the normal sense (would require actually triggering a
release, which is out of scope here) — verified via npm run actionlint (clean) and manual reasoning
about the dispatch semantics. No src/** code touched.

[linear-code]

JSO-3415