Problem

A re-run of the Publish step in the RC and Nightly workflows aborts with:

fatal: tag 'master-rc.<sha>' already exists
Process completed with exit code 128

This happens whenever an earlier Publish run already created the release tag — e.g. after a partial RC where some platform jobs were re-run (rerun --failed). git fetch pulls the existing tag locally, and git tag -s "$TAG" then refuses to overwrite it, so the macOS-ARM artifacts never get appended and the pre-release stays incomplete.

Observed on RC run for master-rc.7354675 (2.7.1 #486): build was fully green, but Publish failed on the re-run; workaround was to delete the release + tag manually and re-run Publish.

Fix

Make tag creation idempotent in cd-release-candidate.yml and cd-nightly.yml:

• drop any stale local tag before recreating it,
• force-push so a re-run can update the existing ref,
• fall back to PATCH if the ref-create API reports the ref already exists.

cd-release.yml already handles this and is left unchanged.