fix(release): create signed annotated tags safely under tag.gpgsign

[Chemaclass]

Summary

release.sh could not tag a release when tag.gpgsign=true is set in git config (the maintainer's setup). A plain git tag <name> under that config tries to create a signed tag, needs a message, and aborts with Please supply the message using either -m or -F option in any non-interactive/CI run — leaving the release half-done.

Changes

• Extract tagging into release::create_tags, which:
  • creates the version tag as annotated with an inline -m message (git signs it automatically when tag.gpgsign=true, and never opens an editor)
  • moves the floating major tag (v0) with -f, pinned to the release commit via ^{} rather than the version tag object
• Apply the same gpgsign-safe tagging in the sandbox flow.
• Add regression tests (test_create_tags_*) — CI-safe (no GPG key needed), asserting tags are annotated, the major tag points at the release commit, and the major tag name is returned.
• Slim the /release skill to a thin reminder now that the whole e2e flow lives in release.sh.

Test plan

• ./bashunit tests/unit/release_*.sh — all green (incl. new tests)
• make sa && make lint — clean
• shfmt — clean
• Reproduced the original failure and verified the fix in a throwaway repo with tag.gpgsign=true