Publish first versioned release for reusable actions

[vitormattos]

Goal

Publish the first real version tag/release for the reusable governance actions.

The project currently declares version 0.1.0 in package.json, but there is no matching Git tag or GitHub Release.

Why

Callers intentionally pin actions to immutable commit SHAs. We also want the human-readable convention:

uses: LibreCodeCoop/github-governance@<full-sha> # v0.1.0

That comment must refer to a real tag pointing to the pinned revision, not just the package metadata.

A real release/tag also gives Dependabot a versioned upstream reference for future updates.

Acceptance criteria

• choose the first stable revision after the current migration fixes;
• create Git tag v0.1.0 pointing to that revision;
• publish a GitHub Release for v0.1.0;
• update LibreSign and LibreCodeCoop callers so both github-governance and github-governance/discover SHA pins include # v0.1.0;
• keep the full immutable SHA in uses:;
• verify Dependabot recognizes future GitHub Actions updates.

[vitormattos]

Release automation is now implemented in #16. After that PR is merged, run the Release workflow from main with v0.1.0, then update the LibreSign and LibreCodeCoop caller SHA pins with the real # v0.1.0 comment and close this issue.

[vitormattos]

v0.1.0 has been published successfully.

Release commit:
5b9ebb58e975854f23ba68adbcf81cfea9b1ec4a

The release workflow completed successfully and the Git tag points to that exact commit.

Remaining work before closing this issue:

• merge chore: pin github-governance v0.1.0 LibreSign/.github#18, pinning both reusable actions to the release SHA with # v0.1.0;
• merge chore: pin github-governance v0.1.0 .github#10 after the pending caller hardening PR feat: add reusable repository discovery action #9, then ensure docs: clarify ruleset read permissions #10 is rebased/rebuilt on the hardened main;
• run organization-wide dry-runs after the new pins are on main;
• require zero drift in both organizations.

The issue should remain open until both production callers are using the released SHA.

[vitormattos]

Completed.

• v0.1.0 was published successfully from commit 5b9ebb58e975854f23ba68adbcf81cfea9b1ec4a.
• Both production callers now pin the discovery and reconciliation actions to that immutable commit with the human-readable # v0.1.0 comment.
• LibreSign and LibreCodeCoop governance runs completed successfully after the pin update.

Future releases remain covered by the documented post-release checklist.