Fix tag-triggered releases: accept unprefixed tags, keep 3.2.0 reachable (#3217)

The 3.2.0 release failed its "Verify tag matches computed version" guard with
"Tag '3.2.0' does not match the computed version '3.2.0-g8460293104'".

Cause: publicReleaseRefSpec still carried the v2-era "^refs/tags/v\d+\.\d+".
The whole v3 line tags without the "v" (3.0.0 ... 3.1.31, 3.2.0), so on a
release event - where GITHUB_REF is refs/tags/3.2.0 - nbgv did not consider the
build a public release and appended the "-g<commit>" suffix. This never bit us
before because release.yml is new (#3213); every earlier v3 package was pushed
from a main build, where the refspec did match. The stray 3.1.1-g7441909d06 on
nuget.org is the same failure mode escaping under the old pipeline.

Relax the refspec to "^refs/tags/v?\d+\.\d+" so both spellings are public.

Because this commit adds to the commit height, drop versionHeightOffset to -3
so the release commit still computes as 3.2.0 rather than skipping to 3.2.1.
versionHeightOffsetAppliesTo is already "3.2", so the height is not reset.

Verified with nbgv on this commit: refs/tags/3.2.0, refs/tags/v3.2.0 and
refs/heads/main all compute NuGetPackageVersion 3.2.0.