How to govern release artifacts: semver, repo promotion, and rollback

When prod pulls a SNAPSHOT, a release was overwritten, or rollback cannot find the prior build: use semver and Git tags on AngusRepo (repo.anguskit.com), immutable HOSTED releases, same-digest promotion, and Deploy Tokens.