Find a convenient way to tag releases (commits) on main without reducing branch protection rules

[yfyf]

Currently pushing directly to main is only possible by temporarily disabling the branch protection requiring all commits to appear via pull requests. This makes it inconvenient to tag a release commit and push both the tag and the commit atomically.

cc @knuton