Document that release tags are signed

[medley56]

Summary

Addresses issue #279.

docs/source/developers.md documented git tag -a for release tags, which creates an annotated but unsigned tag. That has not matched actual practice for some time. This PR brings the docs in line with the convention.

Changes, all confined to docs/source/developers.md:

• Both tag commands (Official Releases and Test Releases) now use git tag -s instead of git tag -a.
• New #### Tag Signing subsection under "Automatic Release Process", placed ahead of both tag code blocks so the rule is stated once.
• A MyST note directive recording that commit.gpgsign does not sign tags: signed tags need either tag.gpgsign = true or an explicit -s on each invocation. This is the actual root cause of the drift and is non-obvious to anyone working outside the devcontainer.
• "Preparing for Release" step 6 now says to tag "using a signed, annotated tag", so signing is discoverable at the point where the reader first meets tagging.

Not changed: the sentence at line 52 saying the workflow "responds to pushes of annotated git tags". .github/workflows/release.yml triggers on the tag name pattern only and does not verify a signature, so calling it "signed" there would describe enforcement that does not exist.

Why "must" rather than "preferred" — review question

The wording asserts that release tags must be signed. Evidence:

• .devcontainer/devcontainer.json sets both COMMIT_GPGSIGN=true and TAG_GPGSIGN=true in remoteEnv, and .devcontainer/setup-dev-environment.sh applies both as git config and errors/warns if signing was requested but is unavailable. Tag signing is deliberate configuration, not incidental.
• Every release tag from 6.0.0rc3 onward is signed (verified against the tag objects): 6.0.0rc3, 6.0.0rc4, 6.0.0, 6.0.1, 6.1.0, 6.1.1, 6.1.2, 6.2.0.

"Preferred" would leave the next maintainer free to use -a, which is the exact failure this fixes. That said, this is a policy call that is yours to make — if you would rather the docs say "should" or "preferred", it is a one-word change and I am happy to soften it.

Out of scope

This PR intentionally does not touch .claude/skills/cut-a-release/SKILL.md, because that file does not exist on main yet — it is added by unmerged PR #278. Its Step 7 "Deliberate deviation from developers.md" callout (and the "The single exception is flagged inline in Step 7" sentence in its preamble) become redundant once this lands, and should be removed in a follow-up after #278 merges; issue #279 should stay open until that cleanup is done. That is why this PR links the issue without a closing keyword.

CHANGELOG

No CHANGELOG entry was added, and I believe none is necessary. The precedent splits on audience: developer-process documentation changes have not gotten entries, while user-facing documentation changes have. #222 ("Update release process docs") and #240 ("Update developer setup documentation") both touched developers.md only and added no entry; #273 (reorganize user documentation) did add one. This PR is squarely in the first category.

Verification

• grep -n "tag -a" docs/source/developers.md returns nothing.
• pre-commit run --all-files passes, including prettier, with no rewrites.
• Docs build clean (uv sync --all-extras && cd docs && make html); docs/build/html/developers.html renders the callout as <div class="admonition note">, not literal text. The note uses a fenced MyST {note} directive rather than a GitHub-style > [!NOTE], since 6.2.0 shipped a fix for exactly that rendering bug.
• git diff --stat main shows only docs/source/developers.md (16 insertions, 3 deletions).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.49%. Comparing base (e6359c6) to head (2dafb37).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #283   +/-   ##
=======================================
  Coverage   94.49%   94.49%           
=======================================
  Files          49       49           
  Lines        4163     4163           
=======================================
  Hits         3934     3934           
  Misses        229      229           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟢 Approval recommended

The focused documentation changes have no unresolved issues.

Pull request overview

This PR updates release documentation to require signed annotated tags.

Changes:

• Replaces git tag -a with git tag -s.
• Adds tag-signing guidance and configuration notes.
• Clarifies signing in the release checklist.

File summaries

File	Summary
docs/source/developers.md	Documents and applies signed release-tag usage.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.