[iAziz786]

Summary

Document that releases follow semantic versioning with a v prefix, and add a repository Git hook that refuses any other tag shape before the push leaves the clone.

 + .githooks/pre-push        # refs/tags/* must match vX.Y.Z (pre-release and build suffixes allowed)
 + AGENTS.md                 # release tags are vX.Y.Z; enable the hook once per clone
 + README.md                 # releases follow semantic versioning, every release tagged vX.Y.Z

The hook reads the refs Git passes on stdin and checks every refs/tags/* entry. Branch pushes pass through. Version matching stays in the release workflow.

git config core.hooksPath .githooks   # once per clone

Evidence

Hook exercised through a real git push --dry-run with core.hooksPath set:

Pushed ref	Result
refs/heads/main	allowed
refs/tags/v0.3.3	allowed
refs/tags/v0.4.0-rc.1	allowed
refs/tags/v0.4.0+build.7	allowed
refs/tags/0.3.3	rejected
refs/tags/v0.3	rejected
refs/tags/release-v0.3.3	rejected
refs/tags/v0.3.3.4	rejected
refs/tags/v01.2.3	rejected

• Before: git push --dry-run origin bad-tag → error: refusing to push tag 'bad-tag': release tags are vX.Y.Z (exit 1).
  After: git push --dry-run origin v9.9.9 → passes; git ls-remote --tags origin v9.9.9 confirms nothing was published.
• Multi-ref push rejected when any tag is invalid.

Merge Danger

Door: two-way — delete the hook file to remove it.

Blast Radius: release process only.

The hook is opt-in per clone, so a clone that never runs git config core.hooksPath .githooks is unaffected. git push --no-verify bypasses it; the release workflow still refuses a tag that disagrees with the Cargo.toml version, so a bypass cannot publish a mismatched release.