Tags now cross only after the release gates. Public assets are read back anonymously and hashed; the Rust Action pin now names its advertised stable commit.