A new tag-and-release job waits for the orb's bump commit and for the
version on Maven Central, checks that the Central artifact was published
after this merge, then creates the signed annotated tag (SSH key from the
QRUN_TAG_SIGNING_KEY secret) on the bump commit and a GitHub prerelease
listing the merged PRs. It never creates an unsigned tag and skips a tag
that already exists.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>