feat(release): publish verified source tags

tools/release/release-catalog.py

@@ -27,6 +27,7 @@ def main() -> int:
     selective.add_argument("--output-dir", type=Path, help="Candidate output directory. Defaults to runtime/release-candidates/<channel>-<timestamp>.")
     selective.add_argument("--public-base-url", default="https://govoplan.add-ideas.de")
     selective.add_argument("--repository-base", default="git+ssh://git@git.add-ideas.de/add-ideas")
+    selective.add_argument("--source-remote", default="origin", help="Configured Git remote containing immutable source tags.")
     selective.add_argument("--expires-days", type=int, default=90)
     selective.add_argument("--sequence", type=int)
     selective.add_argument("--skip-public-check", action="store_true")
@@ -43,6 +44,7 @@ def main() -> int:
     publish.add_argument("--tag", action="store_true", help="Create a website catalog publication tag. Implies --commit.")
     publish.add_argument("--push", action="store_true", help="Push the website branch and tag. Implies --commit.")
     publish.add_argument("--remote", default="origin")
+    publish.add_argument("--source-remote", default="origin", help="Configured Git remote containing catalog source tags.")
     publish.add_argument("--branch")
     publish.add_argument("--tag-name")
     publish.add_argument("--npm", default="npm")
@@ -68,6 +70,7 @@ def main() -> int:
             signing_keys=tuple(args.catalog_signing_key),
             public_base_url=args.public_base_url,
             repository_base=args.repository_base,
+            source_remote=args.source_remote,
             expires_days=args.expires_days,
             sequence=args.sequence,
             check_public=not args.skip_public_check,
@@ -90,6 +93,7 @@ def main() -> int:
             tag=args.tag,
             push=args.push,
             remote=args.remote,
+            source_remote=args.source_remote,
             branch=args.branch,
             npm=args.npm,
             tag_name=args.tag_name,