release: standardize signed tag ceremony

[3leapsdave]

Summary

• add Make-driven guards for release identity, signing environment, live tag-policy validation, local signed-tag creation, guarded push, and GitHub verification
• bind the ceremony to a literal check-verified commit, full primary GPG fingerprint, exact tagger identity, canonical publication-policy attestation, and a direct annotated-tag commit target
• keep minisign and release assets outside this tag-only repository ceremony
• document the maintainer signing handoff and release-operator verification boundary

Fail-closed controls

• reject stale, malformed, abbreviated, or non-commit release identities
• reject dirty or non-main checkouts and moved origin/main
• reject unsigned, lightweight, indirectly nested, wrongly signed, expired, or policy-mismatched tags
• reject release keyrings inside any Git repository, including symlink aliases
• require GitHub to report the published annotated tag as verified at the expected direct commit before release creation

Validation

• DECERNOR_BIN=/absolute/path/to/decernor make check-all
• make release-control-test — 52 hermetic controls
• macOS /bin/bash 3.2 syntax and runtime
• ShellCheck
• live version-tag ruleset validation
• tracked and untracked diff checks

Generated by GPT-5 via Codex under supervision of @3leapsdave

Role: devlead