Tag releases of the reusable workflows so callers can pin instead of @main

Every caller in the fleet pins the reusable workflows at @main:

uses: liberusoftware/.github/.github/workflows/package-tests.yml@main

@main means a change here changes the behaviour of every package's CI at once, with no way for a package to hold a known-good version while it adapts. It is the same objection that applies to floating action tags, and the fleet already knows about that one.

Ask

Tag releases of this repository, so callers can pin:

uses: liberusoftware/.github/.github/workflows/package-tests.yml@1.2.0

Why now

ecommerce-laravel is planning ~100 module repositories that each call these workflows. Rolling a breaking change across 100 pinned callers is a mechanical bump; rolling it across 100 @main callers is a fleet-wide outage that starts before anyone has noticed.

The downstream standard being applied is: third-party actions pinned to full-length commit SHAs, reusable workflows pinned to a tag. This repository is currently the one thing that cannot be pinned.

Found while planning module CI for ecommerce-laravel.

Start by inspecting this repository's reusable workflow definitions and any existing release or tagging configuration. Confirm how callers currently reference @main, then establish version tags for releases and verify that a caller can reference a tag such as @1.2.0 instead.