ci(release): attach revert-to-immich.sql to every release

[Deeds67]

Why

Releases shipped only docker-compose.yml and example.env. The revert-to-immich escape hatch was reachable only by browsing the repo at the right tag — and the file changes every few releases (521 lines on main vs 478 at v5.3.1), so grabbing it from main gives you the wrong set of migrations to undo.

What

Attach scripts/revert-to-immich.sql alongside the existing two assets, at all three call sites:

• gallery-release-server-only.yml — gh release create
• gallery-prerelease-server.yml — gh release upload --clobber (re-run path)
• gallery-prerelease-server.yml — gh release create (first-run path)

Both tag jobs already check out at ref: ${{ needs.version.outputs.sha }}, so the uploaded copy is the script as it stood at that release's commit — no git plumbing needed.

Plus a preflight in each version job. It lands there rather than at upload time because the git tag is force-pushed and all images are built before gh release create runs — a missing script would otherwise fail ~an hour in, with a tag already published and no release. The check reads the blob at $sha rather than test -f on the working tree, because the commit: input can pin an older ancestor than the checked-out ref.

Verification

• Preflight exercised against real commits, both branches: v5.3.1's SHA passes; v4.49.1's SHA (a real commit predating the script) fails with the expected error. Confirms the guard isn't vacuous.
• actionlint 1.7.12, base vs branch: 12 findings → 12 findings. The one apparent delta is the pre-existing SC2129 shifting from script line 25 → 35 due to the inserted lines. No new findings.
• bash -n on both edited run: blocks, and YAML parse on both files.

Related

The 35 existing releases that contain the script (v4.50.0 → v5.3.1, prereleases included) were backfilled separately, each with the version from its own tag — verified by downloading each asset back and matching git hash-object against the tag's blob SHA (35/35). v4.49.1 and older predate the script, so the cut is clean.