The tag-push guard cannot see a Registry publish that never gets a tag
(0.15.97, 0.15.111-113). After a successful publish, create v<X> on the
commit that cut X if it is missing, and fail if the tag points elsewhere.
A daily --published audit of HEAD is the backstop when no tag is pushed.
Changelog matching now recognises `chore: release vX.Y.Z`, so an untagged
previous cut still bounds the next entry instead of re-listing from the
last tag.
Closes#1882
Arthur R Longbottom
efe5587da4