Enforce trusted signed release tags after 1.0

## Context

OpenSSF Best Practices silver criterion `version_tags_signed` suggests that important version-control tags, such as public release tags, be cryptographically signed and verifiable as described in `signed_releases`.

The current `v0.8.0` tag is an annotated tag, but `git tag -v v0.8.0` reports no signature.

## Scope

- Decide whether Registry Stack will sign future important version tags with GPG, SSH signing, Sigstore/Gitsign, or another verifiable mechanism.
- Document the verification process and trusted identity/key material.
- Update release procedure docs so future public release tags are signed.
- Decide whether any existing tags should be replaced, superseded, or left as historical unsigned tags.

## Done when

- Future important release tags are cryptographically signed.
- External users can verify the tag signature using public instructions.
- The Best Practices `version_tags_signed` answer can be updated with public evidence.

## Non-goals

- Do not rewrite existing release history without an explicit release-management decision.

No se indican rutas de archivos. Empieza revisando la documentación del procedimiento de release y comprobando el tag actual v0.8.0 con `git tag -v v0.8.0`; después, rastrea cómo se gestionan los tags de release y el material de identidad de confianza. Se considera terminado cuando se haya elegido un mecanismo de firma, las instrucciones de verificación y el material de confianza sean públicos, los tags importantes futuros estén firmados y se haya documentado el tratamiento de los tags existentes.

Escrito por el modelo de indexación a partir del texto del issue.