Create Source Release Tag

Create one immutable, annotated release tag for the clean HEAD of an owned site's exact .src source tree. Tag must be release-YYYY-MM-DD or release-YYYY-MM-DD-lowercase-suffix. confirm=false only validates and previews the exact HEAD/tag relation; confirm=true creates a new tag without force/overwrite, then reads it back and proves its resolved target equals HEAD. It never builds, publishes, restores, cleans files, changes source content, or accepts an arbitrary path, command, Git directory, tag message or tag target. When the source has no standalone Git repository, a tag is permitted only on the canonical managed snapshot repository after proving that its HEAD contains this exact .src tree; that result is labelled managed_snapshot_source rather than presented as a source-repository tag.