publish a release tag after the artifacts are uploaded.

[copybara-service]

publish a release tag after the artifacts are uploaded.

A release tag was created before the release built, so a failed build left a tag on GitHub with nothing behind it. release-20260824.0 is an example: the build failed, but users still see a release tag that they cannot install.

Before

  make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
                     │
  tag_release.sh     └─ pushes the annotated tag as  release-20260831.0   ← published immediately
                     │
        ┌────────────┴────────────┐
        │                         │
  Buildkite                  GitHub Actions
  (triggered by the tag)     release_mirror.yml
        ├─ make artifacts         ├─ poll GCS for artifacts (240 min timeout)
        ├─ make release           ├─ verify sha512
        └─ gcloud storage cp      └─ create the GitHub Release
           → gs://gvisor/releases/

After

  make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
                     │
  tag_release.sh     └─ pushes the annotated tag as  staging-release-20260831.0
                     │
  Buildkite          ├─ tag.sh stage      restore release-20260831.0 locally (version stamping)
  (triggered by      ├─ make artifacts    x86_64 + aarch64
   the staging tag)  ├─ make release      sign, lay out repo/
                     ├─ gcloud storage cp → gs://gvisor/releases/
                     └─ tag.sh publish    push release-20260831.0, delete staging tag
                     │
  GitHub Actions     └─ release_mirror.yml  verify sha512, create the GitHub Release

update #14398

FUTURE_COPYBARA_INTEGRATE_REVIEW=#14529 from milantracy:githubrelease 3760b72