Let CLI recovery create a new exact release tag

[rmcdaniel]

Problem

The repository-owned recovery workflow can resolve the exact immutable plan but cannot create a previously absent release tag. In run 29746484987, the workflow resolved 0.1.94 at 36bde75882980e834854a145c9ad0f61ceec4659; its GITHUB_TOKEN had contents: write, but POST /git/refs failed with Resource not accessible by integration (HTTP 403). The earlier successful recovery path only verified an already-existing tag, so new-version recovery was never proven.

Acceptance criteria

• An untagged exact release-plan component can create its planned tag at the exact source commit through the repository-owned GitHub recovery workflow.
• Tag mutation authority is repository-scoped, available only inside a protected publication environment, and is not exposed to discovery or pull-request jobs.
• Existing exact tags remain idempotent; an occupied or mismatched tag fails closed without dispatching publication.
• Recovery explicitly dispatches the exact release workflow after tag creation and retains public evidence linking the plan, tag, commit, and publication run.
• Focused tests cover absent-tag creation authority, exact replay, mismatched occupancy, unavailable credentials, and interrupted retry.

Completion

Close only after GitHub recovery creates 0.1.94 at the planned commit, publishes and verifies the complete CLI asset set, and target-branch qualification passes.

[rmcdaniel]

Source implementation landed in bc036e946043 on main.

Required public qualification passed: https://github.com/durable-workflow/cli/actions/runs/29766728200

This issue remains open until its required public completion evidence is verified.

[rmcdaniel]

Release 0.1.94 is published and independently verified from the exact planned source.

• Source authority landed at bc036e946043; Build and Public Boundary passed.
• The protected release-plan recovery run created tag 0.1.94 at exact commit 36bde75882980e834854a145c9ad0f61ceec4659, retained cancellation of the automatic tag-push run, and dispatched the current qualified release policy.
• The explicit release run published all ten required assets and completed successfully.
• The unprivileged recovery verification confirmed the public checksums, GitHub build attestations, source identity, and installable PHAR. A separate clean-container check reports dw 0.1.94 (commit 36bde7588298, built 2026-07-20T07:04:49Z).

Release: https://github.com/durable-workflow/cli/releases/tag/0.1.94

[rmcdaniel]

Completed in bc036e946043 on main.

No package release was required for this source-only change.

Required public qualification passed: https://github.com/durable-workflow/cli/actions/runs/29766728200