Enable dev-kit's tag ruleset on our release tags

Type: security · Component: Makefile

Context

dev-kit#45 adds a tag ruleset to repo-settings.sh that refuses moving or deleting a v* tag.
dev-kit applies it to itself there, because its tags are what every consumer's CI resolves. This
ticket is the other half: our own release tags.

It matters more here than in the products: Solar and ARC both pin go.opendefense.cloud/kit by
version, so a moved v0.5.0 changes what they build against.

What needs to be solved

1. REPO_* first. Unlike the product repos, this Makefile has no REPO_* block, so
   make repo-settings has never been configured here and this repo has no managed branch
   protection either. Decide what the settings should be — Solar's block is a starting point, but
   this is a library, so required checks and review counts may differ deliberately.
2. All four dev-kit pins on a release carrying the ruleset (dev-kit#45). Requires dev-kit v3, so
   Migrate to dev-kit v3.0.0 #132 comes first.
3. Set the ruleset's REPO_* variables and have an admin run make repo-settings. CI cannot —
   the workflow token cannot manage rulesets.

Step 1 stands on its own and is worth splitting out: it unblocks this and gives the repo managed
branch protection either way.

Worth knowing before doing it

Check for a duplicate DEV_KIT_VERSION. This Makefile has carried the variable twice
(v2.0.0 and v2.1.0). Harmless while make takes the last one, but check-dev-kit-pins fails
on it from v3 onward, so collapse it to one line with the bump if it is still there.

Nothing in CI changes from the ruleset. The rules are update and deletion, not
creation, so release-drafter still tags on publish.

A botched release is fixed by bumping, not by retagging. That is the only behavioural change.

Acceptance criteria

• REPO_* block present and reviewed; make repo-settings runs cleanly.
• One DEV_KIT_VERSION line; make check-dev-kit-pins passes.
• All four dev-kit pins on the release carrying the ruleset.
• Moving and deleting an existing v* tag are both refused.
• The next release still tags successfully.

Relations

Needs opendefensecloud/dev-kit#45 released, and #132 for the v3 migration. Sibling tickets in
solution-arsenal and artifact-conduit (artifact-conduit#499 for its migration).