[hack] Address review feedback in create-release-tag.py

- Resolve git executable via shutil.which() and catch OSError in git()
  so callers always receive RuntimeError instead of an unhandled
  FileNotFoundError when git is missing or fails to launch
- Use git rev-parse --verify refs/tags/<tag> in tag_exists() so only
  actual tags (not branches with the same name) return True
- Replace regex date validation with date.fromisoformat() to reject
  invalid calendar dates such as 2026-02-31 at argument-parse time
- Wrap fetch_bundle_info() and fetch_operator_push_date() calls in
  try/except so network, HTTP, or JSON errors surface as clean ERROR
  messages matching the existing git-failure error style

Signed-off-by: Russell Teague <rteague@redhat.com>
Co-Authored-By: Claude <noreply@anthropic.com>

Author: mtnbikenc

hack/create-release-tag.py

@@ -99,8 +99,10 @@
 # pylint: disable=invalid-name  # hyphenated script name is intentional
 
 import argparse
+from datetime import date
 import os
 import re
+import shutil
 import subprocess
 import sys
 
@@ -211,11 +213,23 @@ def fetch_operator_push_date(version: str) -> str:
 # Git helpers
 # ---------------------------------------------------------------------------
 
+_GIT_BIN = shutil.which("git")
+
+
 def git(*args, env=None) -> str:
     """Run a git command and return stdout, raising on failure."""
-    result = subprocess.run(
-        ["git", *args], capture_output=True, text=True, env=env, check=False
-    )
+    if not _GIT_BIN:
+        raise RuntimeError("git executable not found in PATH")
+    try:
+        result = subprocess.run(
+            [_GIT_BIN, *args],
+            capture_output=True,
+            text=True,
+            env=env,
+            check=False,
+        )
+    except OSError as exc:
+        raise RuntimeError(f"failed to execute git: {exc}") from exc
     if result.returncode != 0:
         raise RuntimeError(result.stderr.strip())
     return result.stdout.strip()
@@ -224,7 +238,7 @@ def git(*args, env=None) -> str:
 def tag_exists(tag: str) -> bool:
     """Return True if the git tag already exists in this repository."""
     try:
-        git("rev-parse", tag)
+        git("rev-parse", "-q", "--verify", f"refs/tags/{tag}")
         return True
     except RuntimeError:
         return False
@@ -294,8 +308,11 @@ def main():
     if not re.fullmatch(r"\d+\.\d+\.\d+", args.version):
         parser.error(f"version must be X.Y.Z, got: {args.version!r}")
 
-    if args.date and not re.fullmatch(r"\d{4}-\d{2}-\d{2}", args.date):
-        parser.error(f"--date must be YYYY-MM-DD, got: {args.date!r}")
+    if args.date:
+        try:
+            date.fromisoformat(args.date)
+        except ValueError:
+            parser.error(f"--date must be a valid YYYY-MM-DD date, got: {args.date!r}")
 
     version = args.version
     tag = f"v{version}"
@@ -321,7 +338,14 @@ def main():
         commit_sha = args.commit
         commit_source = "provided manually"
     else:
-        commit_sha, commit_source = fetch_bundle_info(version)
+        try:
+            commit_sha, commit_source = fetch_bundle_info(version)
+        except Exception as err:  # pylint: disable=broad-except
+            print(
+                f"\nERROR: fetch_bundle_info failed: {err}",
+                file=sys.stderr,
+            )
+            sys.exit(1)
         if not commit_sha:
             print(
                 f"\nERROR: Could not resolve commit SHA for {tag}.",
@@ -342,7 +366,14 @@ def main():
         published_date = args.date
         date_source = "provided manually"
     else:
-        published_date = fetch_operator_push_date(version)
+        try:
+            published_date = fetch_operator_push_date(version)
+        except Exception as err:  # pylint: disable=broad-except
+            print(
+                f"\nERROR: fetch_operator_push_date failed: {err}",
+                file=sys.stderr,
+            )
+            sys.exit(1)
         date_source = "operator image push date"
         if not published_date:
             print(