Activate governed release-tag rulesets for VSIX releases

The release workflow redesign in #2794 depends on repository-level tag governance that cannot be applied by a maintainer without administrator permission. A repository administrator must create and verify two active tag rulesets before the new tag-push producer is merged or enabled.

## Acceptance Criteria

- [ ] Create an active `release-tags-creation-by-release-app` ruleset targeting `refs/tags/v*` and `refs/tags/prerelease-v*`.
- [ ] Configure the creation ruleset so only the installed Release App can create matching tags through an `Always` bypass.
- [ ] Create an active `release-tags-immutable` ruleset for the same tag namespaces with no bypass actors.
- [ ] Configure the immutability ruleset to restrict tag updates, force pushes, and deletion.
- [ ] Verify the effective ruleset aggregate and Rules Insights without exposing credentials, tokens, or signed URLs.
- [ ] Confirm the governed tag namespaces before merging or enabling the release producer from #2794.
- [ ] Preserve existing release tags; do not move, delete, or recreate a release identity during verification.

## Related

- Blocks: #2794
- Requires: repository administrator permission and an approved release window for later event-delivery evidence