feat: 支持按 Tag 打包，分支管理可添加 Tag

- 分支管理新增「分支 / Tag」类型选择，Tag 存于 config["tags"]，与分支不可重名
- 每个 Tag 与分支一样拥有同名独立版本轨道，默认上架轨
- 打包页按「分支」「Tag」分组选择；任务新增 ref_type 字段记录引用类型
- Tag 打包时 fetch --tags --force 后以游离 HEAD 检出 refs/tags/<tag>
- 历史记录与下载页按类型显示「分支」或「Tag」

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_build_service.py

@@ -112,6 +112,25 @@ async def test_update_source_existing(tmp_path, log_streamer):
     assert call_count == 4  # fetch, checkout, reset, clean
 
 
+async def test_update_source_tag_checks_out_detached(tmp_path, log_streamer):
+    """Tag 打包：拉取 Tag 后以游离 HEAD 检出 refs/tags/<tag>，不依赖同名远程分支"""
+    source_dir = tmp_path / "workspace"
+    source_dir.mkdir()
+    (source_dir / ".git").mkdir()
+
+    with patch("backend.services.build_service.get_git_remote_url", return_value=""):
+        with patch("asyncio.create_subprocess_exec", return_value=_make_mock_process()) as mock_exec:
+            await update_source("t1", source_dir, "v3.2.0", "tag")
+
+    git_args = [call.args[3:] for call in mock_exec.call_args_list]
+    assert git_args == [
+        ("fetch", "origin", "--tags", "--force"),
+        ("checkout", "--detach", "refs/tags/v3.2.0"),
+        ("reset", "--hard", "refs/tags/v3.2.0"),
+        ("clean", "-ffdx"),
+    ]
+
+
 async def test_update_source_fetch_failure(tmp_path, log_streamer):
     """fetch 失败时抛异常"""
     source_dir = tmp_path / "branches" / "dev"
@@ -136,12 +155,27 @@ async def test_prepare_source_snapshot_serializes_shared_source(tmp_dirs, log_st
     with patch("backend.services.build_service.get_git_remote_url", return_value="git@github.com:test/repo.git"), \
          patch("backend.services.build_service.get_shared_source_dir", return_value=source_dir), \
          patch("backend.services.build_service.BUILD_BASE_DIR", build_dir_parent), \
-         patch("backend.services.build_service.update_source", new_callable=AsyncMock), \
+         patch("backend.services.build_service.update_source", new_callable=AsyncMock) as mock_update, \
          patch("backend.services.build_service.get_source_commit", new_callable=AsyncMock, return_value="abc123"):
         build_dir, commit = await prepare_source_snapshot("t1", task)
 
     assert build_dir.exists()
     assert commit == "abc123"
+    assert mock_update.call_args.args[2:] == ("main", "branch")
+
+
+async def test_prepare_source_snapshot_passes_tag_ref_type(tmp_dirs, log_streamer):
+    source_dir, build_dir_parent = tmp_dirs
+    task = MagicMock(id="tag-task", branch="v3.2.0", ref_type="tag")
+
+    with patch("backend.services.build_service.get_git_remote_url", return_value="git@github.com:test/repo.git"), \
+         patch("backend.services.build_service.get_shared_source_dir", return_value=source_dir), \
+         patch("backend.services.build_service.BUILD_BASE_DIR", build_dir_parent), \
+         patch("backend.services.build_service.update_source", new_callable=AsyncMock) as mock_update, \
+         patch("backend.services.build_service.get_source_commit", new_callable=AsyncMock, return_value="abc123"):
+        await prepare_source_snapshot("t1", task)
+
+    assert mock_update.call_args.args[2:] == ("v3.2.0", "tag")
 
 
 # ---- copy_source_code ----