Create an RC Tag

Require an explicit stable base version in <major>.<minor>[.<patch>] form; treat two components as patch 0. Do not infer it from the branch or package metadata, and do not edit version files while creating the tag. The matching release/<major>.<minor> branch must exist on upstream.

Select the next unused positive RC number for that exact base version unless the user supplies one. Relay uses raw-SemVer tags such as 0.9.0-rc.1, without a leading v.

Before the destructive tag push, require explicit approval. Preserve user changes: do not stash, discard, or switch away from a dirty checkout. Fetch the release branch and tags, require HEAD to equal the upstream release branch, and require the workspace version to equal the stable base version. Verify that both local and remote tags are absent, create a signed annotated tag, verify it with git tag -v, and push only refs/tags/<tag>. Stop on any failed check; never force-update, replace, or delete tags.