fix(ci): force-update tags on deploy fetch

git fetch origin won't replace a tag that already exists locally pointing
at a different commit. When v3.3.5 was force-moved on origin after a
first failed CI run, the staging runner kept the stale tag cached and
re-checked-out the old commit — the compose-env-wiring fix was never
actually applied and the container booted without LEADERBOARD_INCLUDE_TEST_DEFAULT.

--tags --force makes the behaviour safe for moved tags.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy-prod.yml

@@ -29,8 +29,10 @@ jobs:
             docker pull "$IMAGE:$TAG"
             docker tag "$IMAGE:$TAG" golfgame-app:latest
 
-            # Update code for compose/env changes
-            git fetch origin
+            # Update code for compose/env changes. `--tags --force` so a
+            # moved tag (hotfix on top of existing version) updates locally
+            # instead of silently checking out the stale cached position.
+            git fetch origin --tags --force
             git checkout "$TAG"
 
             # Restart app

.gitea/workflows/deploy-staging.yml

@@ -21,8 +21,11 @@ jobs:
 
             cd /opt/golfgame
 
-            # Pull latest code and checkout the release tag
-            git fetch origin
+            # Pull latest code and checkout the release tag. `--tags --force`
+            # so that a tag moved on origin (e.g. hotfix on top of an existing
+            # version) actually updates locally instead of silently reusing a
+            # stale cached tag position.
+            git fetch origin --tags --force
             git checkout "$TAG"
 
             # Build the image