A mutable version tag is a promise the maintainer can break

Covers pipeline hardening fundamentals and the specific, real risk of unpinned third-party CI actions, grounded in a 2024 incident.