fix: use curl for tag creation (raw JSON, not form-encoded) [skip-version]

- gh api -f sends form-encoded data, API expects JSON body
- Use curl -X POST with -d for proper JSON body format
- Returns HTTP 201 (created) or 422 (already exists)

Author: localpibox

.github/workflows/build-and-publish.yml

@@ -155,16 +155,16 @@ jobs:
             echo "Tagging $repo@$VERSION (from $branch)"
             sha=$(git ls-remote "https://github.com/$repo.git" "refs/heads/$branch" | awk '{print $1}')
             if [ -n "$sha" ]; then
-              # GH_TOKEN env var makes gh use PAT for all API calls
-              # Create lightweight tag: POST to /git/refs/{ref} with sha body
-              if gh api "repos/$repo/git/refs/refs/tags/$VERSION" \
-                  --method POST \
-                  -f sha="$sha"; then
+              # Use curl to POST raw JSON (gh api -f sends form-encoded, not JSON)
+              status=$(curl -s -o /dev/null -w '%{http_code}' \
+                -X POST "https://api.github.com/repos/$repo/git/refs/refs/tags/$VERSION" \
+                -H "Authorization: token $LOCALPIBOX_PAT" \
+                -H "Accept: application/vnd.github+json" \
+                -d "{\"sha\": \"$sha\"}")
+              if [ "$status" = "201" ] || [ "$status" = "422" ]; then
                 echo "  ✅ $repo@$VERSION"
-              elif gh api "repos/$repo/git/ref/tags/$VERSION" 2>/dev/null > /dev/null; then
-                echo "  ✅ $repo@$VERSION (already exists)"
               else
-                echo "  ⚠️  $repo tag creation failed"
+                echo "  ⚠️  $repo tag creation failed (HTTP $status)"
               fi
             else
               echo "  ⚠️  $repo:$branch not found, skipping tag"