Signed-tag impl: workflow-mediated release flow + SSH signing key provisioning

[millsmillsymills]

Context

Impl half of ADR-0002 (PR #32). The ADR proposes a workflow-mediated tag-push flow as the only Free-plan mechanism that gates signed-tag-object verification at push time. This issue tracks the impl PR that follows once the ADR is accepted.

Mechanism (per ADR-0002)

1. Flip creation = false → true in modules/ruleset-tag-protection/main.tf. Blocks all direct v* pushes.
2. Declare bypass_actors entry for the millsymills-org-bot-writer GitHub App on the tag-protection ruleset (App ID 3663090).
3. Add workflow_dispatch release workflow on main that:
   • Takes a version input matching v[0-9]+\.[0-9]+\.[0-9]+.
   • Fetches an SSH signing key from AWS Secrets Manager to ${RUNNER_TEMP}/release-signing.key at mode 0600 (mirroring the App-PEM pattern in tofu-apply.yml).
   • Creates a signed tag object on the workflow's HEAD.
   • Runs git verify-tag against .github/allowed_signers — exits non-zero before push if verification fails.
   • Pushes via the writer App (token minted at workflow runtime).
4. Keep the existing post-push release.yml as audit-only for one quarter / three runs, then delete.

Acceptance criteria

• ADR-0002 (PR docs(adr): propose signed-tag enforcement via workflow-mediated push #32) marked Accepted.
• New SSH signing key generated and stored in AWS Secrets Manager under github-app-key/millsymills-org-release-signing (or similar). Public key added to .github/allowed_signers.
• modules/ruleset-tag-protection changes land first under enforcement = "evaluate" so the ruleset behavior can be observed in rule-insights without breaking releases.
• Smoke test: workflow_dispatch run of the new release flow with a v0.0.0-test version succeeds, lands the tag, verify-signed-tag audit also succeeds.
• Negative test (observed in evaluate-mode): direct git push origin v0.0.0-direct from a maintainer's laptop is flagged as a violation in rule-insights.
• enforcement = "active" flip in a follow-up PR after both tests pass.
• Plan-1 completion doc's "Signed-tag enforcement" deferred bullet resolved.

Blocked on

• ADR-0002 acceptance (PR docs(adr): propose signed-tag enforcement via workflow-mediated push #32).
• SSH signing key provisioned to AWS Secrets Manager (out of agent scope without explicit auth — maintainer or one-shot bootstrap re-enable).

Out of scope

• Release artifact building (separate concern).
• Migrating any existing v* tags (none exist; if any are added before this lands, retroactive verification is manual).

References

• ADR-0002: docs/adr/0002-required-signed-tag-check.md
• PR feat(ci): enforce signed-tag-object verification on release #17 — post-push release.yml (becomes audit-only)
• Issue Plan-2: make release-tag verification a required check for v* refs #22 — original Plan-2 issue
• bootstrap/aws-output.json — Secrets Manager naming pattern

[millsmillsymills]

ADR-0002 (PR #32, merged) revised the rollout to three small PRs instead of the original evaluate-mode-then-active sequence. Updated impl scope:

• PR-1 (this issue scope): land the release workflow + bypass-actor wiring on modules/ruleset-tag-protection. creation = false retained (existing behavior). Workflow can be smoke-tested via workflow_dispatch and the bypass-actor block is exercised without changing direct-push behavior.
• PR-2 (new follow-up): flip creation = false → true with enforcement = "evaluate". Direct pushes record a rule-insights violation but are not rejected. Observe for one week; second smoke-test confirms bypass-actor path still works.
• PR-3 (new follow-up): flip enforcement = "active". Sequenced alongside or after PR feat(tofu): flip org rulesets from evaluate to active #16 if observation windows overlap.

This issue continues to track PR-1. Follow-ups for PR-2 and PR-3 will be filed once PR-1 merges.