ci: only publish from tags that are on main

[fern-api]

Why

Fern's SDK regeneration pipeline force-pushes a moving tag (fern-generation-base--fernapi--fern-python-sdk) that points at a synthetic commit which is not on main. Because the publish job in ci.yml currently runs on any pushed tag, these internal tags have been triggering unintended package releases (see the recent releases published without any merge to main).

What

Adds a guard to the publish job so it only publishes when the pushed tag points at a commit that is an ancestor of origin/main:

• checkout with fetch-depth: 0 (full history, so origin/main is available)
• a git merge-base --is-ancestor "$GITHUB_SHA" origin/main check whose output gates the remaining publish steps via if: — for any tag not on main (including the fern-generation-base--* tags) the publish steps are skipped and the job still succeeds

Normal release tags cut from main are unaffected.

We'd also recommend deleting the existing fern-generation-base--* tag in this repo and reviewing the package versions it published. A Fern-side fix to stop pushing these tags entirely is in progress; this is a defense-in-depth guard on the repo side.