[pengzhendong]

Summary

• Build the exact existing release tag supplied to the workflow, so package contents and setuptools_scm versions match the release.
• Build FST bundles directly into the graph artifact directory instead of copying obsolete package-local cache files.
• Validate the requested version, distribution metadata, and all production TSV/FAR resources before uploading to PyPI. Keep the existing secret and master-only publishing condition.

Test plan

• Reproduced the missing release-tag checkout and obsolete graph paths before editing.
• Verified YAML structure, shell syntax, Python verification syntax, tag pinning, and all four graph cache arguments.
• Built wheel and sdist from exact v1.3.0 contents; verified version 1.3.0 and all 902 production resources.
• Both distributions pass twine check; git diff --check passes.