fetch opentofu modules from the v-tag git archive, not a release asset (#1755) (#1756)
vrg-vm create off-platform 404d at fetch-modules: the URL embedded the version in both the release tag and the filename (from the v2.1 minor pin), but vergil-vm publishes per-patch release assets and v2.1 is only a git tag, not a release. Fetch GitHubs auto-generated source archive at the tag (archive/refs/tags/{tag}.tar.gz) instead — a single unauthenticated GET, no release asset to maintain; the moving v2.1 tag tracks the latest 2.1.x. The archive roots at vergil-vm-/, so locate modules via a */opentofu/modules glob. Companion: vergil-vm drops its now-unused publish-modules CD job.