[omermorad]

The tagging workflow currently creates only the supplied tag and leaves package tags unsigned. Replace that single-tag operation with a signed batch covering every public package discovered by Lerna, plus an optional global beta tag, at an explicitly approved commit on next.

Use lerna list and lerna exec with native Git/GPG signing so tagging preserves the approved commit and existing package versions. Verify all new signatures and push the complete batch atomically. Preserve existing tags for unchanged independent packages; reject conflicting global tags or changed packages that reuse an existing version. Retries create only missing tags, and historical unsigned tags are not rewritten.

Keep the existing release environment approval and serialized release concurrency. Import the dedicated signing key only for a nonempty batch, validate its fingerprint/email, and clean the runner keyring even after failure. The release environment's key, identity variables, and recovery certificate are configured; the public key is registered to Omer's GitHub account with a verified no-reply email and expires on 2027-10-31. Update the release documentation with setup and usage.

Validation: pnpm build, pnpm lint, pnpm test (14 passed), and pnpm test:e2e (361 passed, 1 skipped). Temporary repositories and a disposable key exercised Lerna package discovery, private-package exclusion, signed package/global tags, signature verification, retries, preservation of old tags, conflicting package/global targets, version reuse, missing keys, mismatched email, cleanup, and atomic rejection of a concurrent remote tag conflict. Workflow YAML, shell syntax, and actionlint 1.7.12 passed.

No real release tags were created or pushed, and the workflow has not been dispatched. Publishing remains separately approved; its existing requirement that package tags match the approved publishing commit is unchanged.