[RomneyDa]

Layer 1 of 2. Base: main. Ordered stack: #138 temporarily removes tag-signature admission → #139 restores it. Retarget #139 to main before merging this PR; merge the restoration separately when the temporary allowance is no longer needed.

What Problem This Solves

Fixes Gateway MSIX source selection failing when an upstream release has an unsigned Git tag, including v2026.9.6 and v2026.9.7.

User Impact

Packaging builds can resolve unsigned upstream releases. Official publication still requires the reviewed exact commit, Gateway tag, and payload version. This hotfix does not advance the release-policy pins or change Windows package signing.

Why This Change Was Made

Remove the GitHub tag-signature admission requirement while retaining annotated-tag identity, direct commit targeting, registry repository/integrity, package-version, and available registry gitHead checks. Upstream authentication now relies on repository controls and reviewed publication approval rather than additionally requiring a Git tag signature. Update the README and regression coverage for unsigned or absent verification evidence.

Evidence

Validated head: eeefda4

• All 52 source-resolution tests passed; the unsigned-tag regression failed on the original implementation with the signature-admission error.
• Signing-input policy suite passed on macOS PowerShell, with process-local TEMP set to the platform temporary directory.
• Documentation reference checker: zero findings; git diff --check passed.
• Live authenticated source resolution of v2026.9.7 succeeded and matched commit c074824a27c96d3983043f9eeb33823cd1772d8c. No release policy file or upstream tag was changed.
• Independent autoreview: no actionable P0/P1 findings.
• Windows MSIX build, installation/upgrade, and official signing/publication were not run locally; this PR changes source admission only.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.