[Phase 1] Tag protection + document scoped mutable-ref exception to SHA-pin standard #505

Parent: #495 · Phase 1 · Work type: Security · Targets SC4 integrity.

The channel-tag model relies on mutable moving tags (stable/next/ring*), which is a deliberate, scoped exception to AGENTS.md's "SHA-pin actions" rule (that rule targets third-party actions; these are first-party workflows we own). Make the exception safe and explicit:

• Add tag-protection rules so a channel tag can be moved only by the gated promotion workflow's identity — not humans, not the agents.
• Keep immutable vX.Y.Z tags as the real audit/rollback targets a channel tag points at.
• Ensure every channel-tag move is a reviewed, logged promotion run.
• Document the scoped exception in AGENTS.md (or the runbook) so future compliance audits don't flag the moving tags as unpinned.

Done when: tag-protection configured; AGENTS.md documents the exception; a manual tag move by a non-promotion identity is rejected.

Ref: docs/initiatives/agentic-release-strategy.md §5.1, §8 (mutable-ref risk).