fix(release): push TypeScript tag in RC builds (#25)

## Summary

Fixes a bug where the TypeScript client tag was created but never pushed
during RC builds, causing the final release workflow to fail with "Tag
vX.Y.ZrcN does not exist for stack-client-typescript".

## Root Cause

In `upload-packages-and-tag/main.sh`:
- Tags are created for all repos (including TypeScript) at line 107
- The lockfile update loop skips TypeScript with `continue` (line 131) 
- Tag push happens **inside** that lockfile loop (line 161)
- Result: TypeScript tag never gets pushed

## Fix

Split the logic so TypeScript tags are pushed immediately after
creation, before the lockfile update loop runs for Python repos.

## Test Plan

- [x] Manually created and pushed the missing `v0.3.1rc5` tag for
TypeScript client
- [x] Re-ran the failed release workflow (run #18987010208)
- [ ] Next RC build will verify the fix works end-to-end

Author: ashwinb

actions/release-final-package/main.sh

@@ -101,6 +101,10 @@ run_precommit_lockfile_update() {
   # Use pre-commit to update lockfiles (uv.lock and package-lock.json)
   # LLAMA_STACK_RELEASE_MODE=true signals hooks to update lockfiles
   # Note: pre-commit exits with non-zero when it modifies files, which is expected
+  if ! command -v pre-commit &> /dev/null; then
+    echo "ERROR: pre-commit is not installed" >&2
+    exit 1
+  fi
   echo "Running pre-commit to update lockfiles..."
   LLAMA_STACK_RELEASE_MODE=true pre-commit run --all-files || true
   echo "pre-commit run completed."
@@ -299,8 +303,9 @@ done
 echo "Release $RELEASE_VERSION published successfully"
 
 # Auto-bump main branch version (create PR)
+# Only bump the stack repo, not client libraries
 if ! is_truthy "$LLAMA_STACK_ONLY"; then
-  echo "Creating PR to bump main branch version"
+  echo "Creating PR to bump main branch version for stack repo"
 
   # Calculate next dev version: 0.1.0 -> 0.1.1.dev0
   MAJOR=$(echo $RELEASE_VERSION | cut -d. -f1)
@@ -311,12 +316,13 @@ if ! is_truthy "$LLAMA_STACK_ONLY"; then
 
   echo "Next dev version: $NEXT_DEV_VERSION"
 
-  for repo in "${REPOS[@]}"; do
+  for repo in "stack"; do
     cd $TMPDIR
 
     if [ "$repo" != "stack-client-typescript" ]; then
       uv venv -p python3.12 bump-main-$repo-env
       source bump-main-$repo-env/bin/activate
+      uv pip install pre-commit
     fi
 
     cd llama-$repo

actions/upload-packages-and-tag/main.sh

@@ -32,6 +32,10 @@ run_precommit_lockfile_update() {
   # Use pre-commit to update lockfiles (uv.lock and package-lock.json)
   # For RC builds, LLAMA_STACK_RELEASE_MODE=true with UV config pointing to test.pypi
   # Note: pre-commit exits with non-zero when it modifies files, which is expected
+  if ! command -v pre-commit &> /dev/null; then
+    echo "ERROR: pre-commit is not installed" >&2
+    exit 1
+  fi
   echo "Running pre-commit to update lockfiles..."
   UV_EXTRA_INDEX_URL="https://test.pypi.org/simple/" \
     UV_INDEX_STRATEGY="unsafe-best-match" \
@@ -122,12 +126,23 @@ for repo in "${REPOS[@]}"; do
   cd ..
 done
 
+# Push TypeScript tag immediately since it doesn't need lockfile updates
+for repo in "${REPOS[@]}"; do
+  if [ "$repo" == "stack-client-typescript" ]; then
+    cd llama-$repo
+    org=$(github_org $repo)
+    echo "Pushing tag for llama-$repo (no lockfile updates needed)"
+    git push -f "https://x-access-token:${GITHUB_TOKEN}@github.com/$org/llama-$repo.git" "v$VERSION"
+    cd ..
+  fi
+done
+
 # Update lockfiles now that packages are published to test.pypi
 # Force-move tags to include lockfile updates
 echo "Updating lockfiles after publishing to test.pypi..."
 for repo in "${REPOS[@]}"; do
   if [ "$repo" == "stack-client-typescript" ]; then
-    # TypeScript client doesn't need lockfile updates
+    # TypeScript client doesn't need lockfile updates (already pushed above)
     continue
   fi