Sign release tags (annotated + GPG-signed)

Harden the release process by producing **signed, annotated** release tags. Today release tags are lightweight commit refs with no signature:

```
$ git tag -v v5.0.17
error: v5.0.17: cannot verify a non-tag object of type commit.
```

## Ask

- Configure the release workflow to create annotated tags signed with a key controlled by the release identity (or via GitHub's `--sign-tag` automation in `create-release.yaml`).
- Document the signing key (or signer identity) and how to verify a tag.
- Enforce signed-tags on the protected release ref so unsigned tags can't be pushed.

## Why

- Provenance: `git tag -v v5.x.y` should cryptographically confirm the tag came from the release pipeline / authorized signer.
- Defense-in-depth alongside [CORE-3054](https://harperdb.atlassian.net/browse/CORE-3054) (GITHUB_TOKEN audit, [HarperFast/harper#568](https://github.com/HarperFast/harper/issues/568)).

Reference: [GitHub docs — Signing tags](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-tags).

## Acceptance criteria

- Newly-created release tags are annotated and signed.
- `git tag -v ` succeeds against any post-change release.
- Branch/tag-protection rules enforce signing on the release ref.
- Documented in release runbook.

## Scope

Both `HarperFast/harper` and `HarperFast/harper-pro` (harper-pro is what end-users install, so its tags are the customer-facing artifact, but harper's tags should be signed too for consistency).

---

Tracked in Jira: [CORE-3030](https://harperdb.atlassian.net/browse/CORE-3030)

🤖 Filed by Claude on behalf of Kris.