Tag v<version> on every verified push to main #489

Problem

The installer planned in epic #482 fetches a pinned tag tarball, but the repository has no
git tags: the version lives only in .claude-plugin/plugin.json.

Evidence

• .claude-plugin/plugin.json:3 — "version", bumped on every change (ADR 0022,
  scripts/check-plugin-version.sh).
• .github/workflows/verify.yml:3-10 — runs on push: main with contents: read.
• .claude/CLAUDE.md allows --rebase merges, which push several commits and no merge
  commit.
• Justfile actions-check recipe gates workflows with actionlint and zizmor.

Expected

A workflow that, only after Verify succeeds for a push to main, tags that pushed head
(github.sha) as v<version> from .claude-plugin/plugin.json; idempotent on re-run;
fails loudly if the tag already exists at a different commit; least-privilege permissions;
passes just actions-check. After a merge and green Verify,
git ls-remote --tags origin v<version> returns the pushed head.

Proposed approach

workflow_run on Verify with a success-conclusion guard, or a job in verify.yml gated on
the suite — whichever the ADR (#488) names. Closed not-planned if #488 declines the
installer. Bump .claude-plugin/plugin.json (PATCH).

Part of #482
Blocked by #488