Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/update_protobufs.yml:
- Around line 52-55: Update the tag validation and resolution flow in the
protobuf update workflow: use git show-ref --verify --quiet with
refs/tags/${target} to require an exact tag name, then resolve
refs/tags/${target}^{commit} for checkout. When target is unset, select the
latest release explicitly rather than relying on git describe from the
checked-out submodule commit.
- Around line 49-50: Update the no-version fallback in the workflow’s
tag-resolution logic to search all fetched tags, select the newest tag matching
the protobuf release pattern, and fail explicitly when no matching tag exists;
do not use git describe’s reachability-based selection.
- Around line 44-47: Update the workflow’s version handling to pass
github.event.inputs.version and github.event.client_payload.version through the
step environment, then read them via quoted shell variables before validation so
command substitutions cannot execute. Also pass the step output through env at
the steps around lines 65 and 90, and replace direct output interpolation with
printf when writing GITHUB_OUTPUT.