pre-push-tags: accept a release tag whose commit is the remote head of release/X.Y.Z #4942

Problem. The local tag guard (scripts/hooks/pre-push-tags.sh, branch a7w/pre-push-tags, installed into the shared clone) accepts a release tag only if its commit is on the remote's main. A release cut from a release/X.Y.Z branch is never on main before its tag: the merge queue squashes the merge-back. So every release tag push is refused. v0.70.2 hit it on 2026-10-07 and v0.70.3 hit it on 2026-10-09 at 06:33Z. Option B was named on 10-07 16:18Z, but no ticket was filed then.

Change. Also accept a create of vX.Y.Z (and vX.Y.Z-rc.N) whose peeled commit equals the remote head of refs/heads/release/X.Y.Z (the exact head, not an ancestor). Everything else stays as it is: the marker naming tag and sha, the TTL default 600 s and cap 3600 s, one-shot removal, and the refusal of deletes, moves and non-release names.

Done when:

• a red/green case table includes: tag at the release head (green); tag at an ancestor of the release head (red); tag at the head of a different release branch (red); release branch absent (red); unmarked, expired or over-cap marker at the release head (red); move or delete (red).
• a mutation that drops the equality, or swaps it for an ancestor test, turns the table RED.
• it gets a non-author sign-off round bound to the final commit, 2 non-author reviews, and green CI.
• the guard lands on main (today it is only on a7w/pre-push-tags), then --install from main's copy, then --verify --all-worktrees.

Refs #4926 (release train 0.70.3).

🤖 Generated with Claude Code