fix: guard source-side tag pushes, the one hole no branch protection covers

`git push origin refs/tags/v1.2.3` published a release tag unattended. The
guard was spelled `*:refs/tags/*`, which only ever saw the destination-side
form — the same colon-shaped blind spot that let `refs/heads/main` through, one
line up in the same list. Both are now spelled without the colon
(`*refs/tags/*`, `*refs/heads/main*`), each subsuming its destination-side form
rather than sitting beside it.

The maintainer found this one by hand and named it on the PR; it was left open
by the previous commit, which read the reviews and not the thread. That reading
gap is fixed separately in `fix/resume-reads-comments`.

This entry is deliberately settled ahead of the open question about the
protected-BRANCH patterns, because it does not depend on it: a tag is not a
branch, so no `enforce_admins` setting covers publishing one, and the guard is
required whichever way that argument goes. `git push origin v9.9.0` — a tag
without the `refs/` prefix — is caught by `* v*`, which stays.

Verified both new pins are holes against the pre-fix settings and guarded
after, that the destination-side spelling `HEAD:refs/tags/v1.2.3` still matches
(so dropping the colon regressed nothing), and that `git push origin
my-feature` and `git push -u origin fix/issue-620` stay unattended. Gate now
checks 105 shapes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012LExo6fcbup75vtc9NfoAR

Author: johanzander

.claude/settings.json

@@ -100,7 +100,7 @@
       "Bash(git push *--all*)",
       "Bash(git push *--branches*)",
       "Bash(git push * +*)",
-      "Bash(git push *:refs/tags/*)",
+      "Bash(git push *refs/tags/*)",
       "Bash(git push * v*)",
       "Bash(git push * main)",
       "Bash(git push * main *)",
@@ -129,7 +129,7 @@
       "Bash(git -* push *--all*)",
       "Bash(git -* push *--branches*)",
       "Bash(git -* push * +*)",
-      "Bash(git -* push *:refs/tags/*)",
+      "Bash(git -* push *refs/tags/*)",
       "Bash(git -* push * v*)",
       "Bash(git -* push * main)",
       "Bash(git -* push * main *)",

CLAUDE.md

@@ -313,6 +313,7 @@ git push origin --delete release-X.Y  # destroys a shared ref
 git push origin v9.9.0                # publishes a release tag
 git push origin HEAD:main             # protected ref via colon refspec
 git push origin refs/heads/main       # bare source-side refspec: no space, no colon
+git push origin refs/tags/v1.2.3      # same, for a TAG: `*:refs/tags/*` saw only the colon form
 git push --all                        # every local branch, main included
 git push --branches origin            # exact synonym for --all
 gh api repos/o/r/pulls/N/merge -X PUT # merges, bypassing `gh pr merge`
@@ -332,6 +333,12 @@ simply was not; `--branches` is its documented synonym (`git push --help`:
 "--all, --branches") and was added in the same pass rather than waiting to
 become the fourth leak.
 
+`refs/tags/` had the same colon-shaped blind spot as `refs/heads/`, and it is
+the one entry here that **branch protection can never replace**: a tag is not a
+branch, so no protected-branch setting covers publishing a release tag. Both
+guards are now spelled without the colon (`*refs/tags/*`, `*refs/heads/main*`),
+each subsuming its destination-side form rather than sitting beside it.
+
 The marker sits at an arbitrary argument position. The first enumeration was
 **prefix-anchored** — `Bash(git push --force*)` — which genuinely cannot reach
 position 3, so it leaked every line above and was replaced by a blanket

scripts/quality-check.sh

@@ -310,6 +310,17 @@ MUST_BE_GUARDED = [
     # its neighbours --mirror/--prune/--tags were all covered. `--branches` is
     # a synonym for it (git 2.50 `git push --help`: "--all, --branches"), so
     # enumerating one without the other would have been the next leak.
+    # A TAG push, source-side. `*:refs/tags/*` only ever saw the
+    # destination-side spelling, so `git push origin refs/tags/v1.2.3` -- the
+    # ordinary one-sided form -- published a release tag unattended. The guard
+    # is now `*refs/tags/*` without the colon, covering both sides.
+    #
+    # This one is guarded regardless of how the protected-BRANCH argument is
+    # settled: a tag is not a branch, so branch protection never covers it, and
+    # `git push origin v9.9.0` (no refs/ prefix) is not covered by this pattern
+    # either -- `* v*` is what catches that, and it stays.
+    "git push origin refs/tags/v1.2.3",
+    "git -C x push origin refs/tags/v1.2.3",
     "git push --all",
     "git push --all origin",
     "git push --branches origin",