fix(analyzer): force-fetch upstream tags to tolerate fork history rewrites (#3)

The fork has rewritten history at v3.17.2 (different SHA than upstream's),
which caused `git fetch --tags upstream` to exit non-zero mid-fetch with:

  ! [rejected] v3.17.2 -> v3.17.2 (would clobber existing tag)

Most tags were fetched successfully but the pipeline aborted in
ensureUpstreamRemote before reaching pass 1.

Add --force so upstream tag SHAs always win in the ephemeral CI clone.
The CI runner is single-use and never pushes, so overwriting local tag
pointers is safe. The fork's own refs remain untouched since the clone
is discarded after the run.