Tag releases are unordered and unprotected: :latest moves before smoke tests and crates.io, with no rollback or tag ruleset #126

A v* tag starts three independent workflows (container-image.yml, publish.yml, release-builds.yml) with no ordering, shared gate or rollback.

• container-image.yml pushes :<version> and :latest, then runs smoke-verify, including the tag-versus-binary version check, after :latest has already moved. Nothing rolls it back.
• publish.yml then fails today (no cargo environment or credential, crates.io publishing has no owner or credential in this repository: next v* tag cannot publish the crate #121), leaving a partial release: images published, crate not.
• Every prerelease tag moves :latest.
• The repository has no rulesets and main is unprotected (checked 2026-10-08), so anyone with write access can push v* from any commit and repoint :latest.
• workflow_dispatch from any branch overwrites :nightly.

Proposal:

• One release workflow, or chained workflows with needs::
  1. verify the tag against Cargo.toml before any push;
  2. push :<version> only, and smoke-test it anonymously by digest;
  3. publish the crate and attach release assets;
  4. only then promote :latest by digest (docker buildx imagetools create), and only for non-prerelease versions.
• A tag ruleset restricting who can create v*, protection on main and develop, and a tag-only deployment policy on the cargo environment.
• Restrict the workflow_dispatch push to develop.

Authored by Claude Code on behalf of @magnificentlycursed.