Release artifacts are mutable

[miinso]

github releases can be edited and assets re-uploaded at any time. this means a published checksum can silently become wrong if someone replaces an artifact. github has an immutable releases feature (GA oct 2025) but it's not enabled.

ref #1

[miinso]

tested on miinso/immutable-test: tags are permanently locked once an immutable release is published on them. even after deleting the release, git push --force on the tag fails with GH013: Cannot update this protected ref. the tag is frozen forever.

this means v21.1.8 must be retagged BEFORE publishing. drafts don't lock tags, only publish does.

[miinso]

also: deleting an immutable release burns the tag name permanently. you can create a draft on it but publishing fails with 422: tag_name was used by an immutable release. asset download URLs also go 404 immediately.

so delete-and-redo is not a recovery path. if we publish on the wrong commit, only option is a new version number.

[miinso]

i say we defer immutability until after bcr merges. bcr presubmit might need iteration (retag, re-upload source tarball), and with immutability on, tags lock permanently on publish.