Turn on tag protection: immutable sol-v* and next-v* via org rulesets

[thedavidmeister]

Turn on tag protection (org rulesets for sol-v* and next-v*)

Release identity now lives in git tags, and nothing today stops a tag from being moved or deleted after the fact. Enable org-level repository rulesets targeting tags so a release/intent tag is create-once-immutable.

Tag patterns and why they need protecting

• sol-v* — minted by every Soldeer publish (libraries via rainix-autopublish, deploy repos via rainix-tag-release) as the published-release record; on deploy repos a sol-v* push is also the release trigger. Moving or deleting one rewrites what a release was, and (deploy repos) re-pushing could re-trigger.
• next-v* — post rainix-autopublish: version intent from next-v git tags; drop all foundry.toml release metadata #335/Version intent from next-v git tags; foundry.toml carries no release metadata #336, these carry version intent: publish_version = max(patch_bump(newest published), newest next-v tag). A moved/deleted intent tag changes what the next release is numbered.

Requested ruleset (tag target, org-wide, ~ALL repositories)

• Restrict updates — an existing sol-v* / next-v* tag can never be force-moved.
• Restrict deletions — cannot be deleted.
• (Immutability = updates + deletions restricted; creation stays open so the release workflows can still mint sol-v*.)
• Bypass: org admins only (for genuine mistakes), everything else denied.

Creation-authorization note (decide separately, do not block the immutability ruleset)

Creation restriction is trickier and is NOT part of the core ask:

• Library sol-v* are created by the CI app — restricting creation would need that app in the bypass list.
• Deploy-repo sol-v* authorize a release (they trigger rainix-tag-release), so who may create them is a deploy-authorization decision worth a restricted creator set — but that needs the CI identity handled and is repo-class-specific. Track as a follow-up; the immutability rules above are the immediate win.

Why filed, not applied

Rulesets are org settings needing admin:org; the session token lacks that scope. This issue is the action item for someone with org-admin.

Context

• rainix-autopublish: version intent from next-v git tags; drop all foundry.toml release metadata #335, Version intent from next-v git tags; foundry.toml carries no release metadata #336 (registry-derived versioning + next-v intent tags), merged 2026-08-19.
• Deploy repos still push the release commit back to main (rainix-tag-release); that is a separate open item and does not depend on this.