feat(releasing): tag approved minor release merges

[pront]

Summary

Automate the handoff from release approval to tagging so maintainers do not have to choose and push
the release commit manually. This saves release-manager time and avoids tagging the wrong commit.

Bot preparation PR squash-merges into master
                    |
                    v
Validate the merged release files and matching approved PR
                    |
                    v
Require active release freeze and unchanged master
                    |
                    v
Atomically create v0.59.0 + v0.59 at the approved commit
                    |
                    v
Existing release workflow starts from the tag

Minor releases only. Publication and post-release housekeeping remain separate follow-ups.

References

• Follows feat(releasing): automate release preparation PRs #26395
• Split from feat(releasing): automate approved releases #26289

Vector configuration

N/A; release tooling and workflows only.

How did you test this PR?

• cargo test --locked -p vdev: 165 unit tests and 20 release integration tests passed.
• cargo clippy --locked -p vdev --all-targets -- -D warnings passed.
• make fmt, make check-prettier, ShellCheck, and git diff --check passed.
• All 69 sandbox regressions passed locally with Bash 5 and in the
  hosted sandbox run.
  They exercise the actual workflow script against temporary Git remotes, including retries,
  conflicting refs, moved master, and atomic failure. The hosted run also passed all 20 release CLI
  integration tests. No real release refs or artifacts were published.

Does this PR include user facing changes?

• Yes. Please add a changelog fragment based on our guidelines.
• No. A maintainer will apply the no-changelog label to this PR.

Contributor Guidelines

• Please read our Vector contributor resources.
• Do not hesitate to use @vectordotdev/vector to reach out to us regarding this PR.
• Before pushing, follow our pre-push guidance.
• After a review is requested, please avoid force pushes to help us review incrementally.
  • Feel free to push as many commits as you want. They will be squashed into one before merging.
  • For example, you can run git merge origin master and git push.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T19:46:48.581885Z	936e8a6	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-17T19:46:04.546089Z	936e8a6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 936e8a6a56

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".