Clarify release signing key separation

[xxvcc]

Summary

• distinguish the OpenPGP tag key from the offline ed25519 artifact key
• pin the Git identity, target commit, and signing-subkey fingerprint in the tag ceremony
• clarify the pre-push and GitHub verification requirements

Testing

• go test -race -count=1 ./internal/selfmanage
• actionlint 1.7.12
• zizmor --pedantic 1.28.0 with online audits
• git diff --check