Copy check_version from numpy to make sure we build from a tag when we upload to PyPI

This seems useful:
https://github.com/numpy/numpy-release/blob/ff6643cbdf5bcd6f5ef5430682d2cb1b385a2e72/.github/workflows/wheels.yml#L240-L256

  check_version:
    name: Ensure commit is tag before upload to PyPi

    if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'pypi'
    needs: [build_wheels, build_sdist]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout numpy
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          repository: numpy/numpy
          ref: ${{ env.SOURCE_REF_TO_BUILD }}
          path: numpy-src
          fetch-depth: 0
          fetch-tags: true
          submodules: false
          persist-credentials: false

      - name: Examine git commit
        run: |
          cd numpy-src
          hash=$(git describe HEAD)
          echo $hash
          if [[ $hash == *"-"*"-"* ]]; then
            echo "SOURCE_REF_TO_BUILD is not a tag"
            exit 1
          else
            echo "SOURCE_REF_TO_BUILD is a tag"
          fi;

Start by locating the GitHub Actions workflow that builds and uploads release artifacts, then compare its PyPI path with the linked numpy workflow. Add a check for the source commit before upload so a non-tagged build fails, and verify the workflow still permits tagged PyPI releases.