2.18.1

CI/CD

• Release tags are created through the GitHub refs API instead of git push. A tag push from an Actions token is refused whenever the tagged commit's .github/workflows tree differs from the branch being pushed — reporting a missing workflows permission that GITHUB_TOKEN cannot hold — which is true of every tag predating the current workflow set, and --atomic made one such tag fail the whole run. So the first run of the workflow created nothing at all, neither the historical backfill nor v2.18.0. Creating the ref through the API is not subject to that check and, like a GITHUB_TOKEN push, starts no workflow run, so a backfilled tag still cannot fire an old production deploy. Refs are now created one at a time, which is what drops the atomic guarantee: a run that fails partway leaves its earlier tags in place, and because publishing reads the remote tags first, the next run creates exactly what is still missing. (#604)