Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/fern-docs-preview-build.yml:
- Around line 62-64: The git checks should explicitly target tag refs instead of
any ref; update the snippet that uses git rev-parse "$version" and git archive
"$version" to use refs/tags/$version (e.g., git rev-parse "refs/tags/$version"
and git archive "refs/tags/$version") so the existence check and archive
operation only resolve tag refs and cannot accidentally pick up branches or
commits.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/fern-docs-preview-build.yml:
- Line 65: The current sed invocation that rewrites only <img> tags (the find
... -exec sed -i 's/<img \([^>]*[^/]\)>/<img \1 \/>/g' {} + command) must be
extended to perform the same MDX-safe sanitizations used by the publish
workflow: escape or replace bare `{`, `}`, and un-closed `<` characters so they
won't be interpreted as JSX/MDX. Update the command sequence invoked by the find
-exec (or replace it with the same series of sed substitutions used in the
publish workflow) so it performs all three sanitizations (img tag self-closing
plus sanitizing `{`, `}`, and `<`) on the matched '*.md' files, ensuring parity
with publish.

In @.github/workflows/publish-fern-docs.yml:
- Around line 49-55: The workflow step enables pipefail but doesn't fail fast on
command errors; update the shell safety flags at the start of the block (replace
or augment the existing set -o pipefail) to include -e (e.g., set -e -o pipefail
or set -euo pipefail) so the git archive and tar extraction pipeline (the for
loop handling fern/versions/v*.yml, git archive "refs/tags/${version}" -- docs/
| tar -x --strip-components=1 -C "fern/versions/${version}-content") will abort
the job immediately if any command in that pipeline fails.