Add a Git tagging policy for TeachLink Backend

[Emoji-dot]

Summary of the work
Task: close a governance gap by adding a Git tagging policy for TeachLink Backend, within a two-file budget and confined to Governance .

Files changed (exactly 2, both in Governance ):

1. New —Governance/policies/TAGGING.md (v1.0.0, Active)
   • Naming convention: tag =v + exact package.json version →v..[-.] ; annotated only, one tag per version, lowercase, no build metadata, no environment tags, immutable once published.
   • Who may tag: contributors/reviewers/triagers/committers — no; maintainers, release manager, lead maintainer — yes; and only after the go/no-go decision is recorded. Tagging never substitutes for final release authorization.
   • Signing requirement: every release tag must be an annotated, cryptographically signed tag (git tag -s ), signed with the individual maintainer's own registered key; verification table (git tag -v, remote object check); prohibited practices; remediation for unsigned/lightweight/wrongly-signed tags.
   • Plus: tag creation procedure, regression-test rationale, change documentation rules, related documents, and known limitations.
2. Updated —Governance/CHANGELOG.md : one entry under [Unreleased] → Added .
   Verification performed:

• git status --porcelain → onlyM Governance/CHANGELOG.md + Governance/policies/TAGGING.md (no changes outsideGovernance/ ).
• Every relative link checked to resolve on disk; cross-referenced section numbers checked against the source docs (VERSIONING.md RELEASE_SIGNOFF.md RELEASE_MANAGER.md CONTRIBUTING.md squash-merge rule).
• Confirmed no test/lint/build surface is reachable: Jest rootDir: 'src' ,tsconfig.build.json includessrc/**/* , ESLint globs {src,apps,libs,test}/**/*.ts , Prettier globs src /test only, dockerignore excludes .md. So no regression is possible and no test was needed or added. Gaps documented rather than hidden:scripts/bump-version.sh and docs/release-automation.md still create unsigned git tag -a tags; there is no in-repo maintainer signing-key list and no tag-push release workflow in github/workflows. All three sit outsideGovernance , so fixing them is a separate change.

close #1839

[drips-wave]

@Emoji-dot Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[RUKAYAT-CODER]

Thank you for contributing to the project.