For `project`, improve security of releases (suggestion)

[pylapp]

Context

Today in 2026 we, open source maintainers and users, face a lot of supply chain attacks.
These attacks are based sometimes on maintainers accounts compromises were attackers push rogue version of releases.
It could be nice, like we do in OUDS iOS, to:

• use the GitHub immutable release feature to block the tag in use for a given release
• use signed tags to proove the tags are legit (with in documentation a way to check the origin of the tag like we did on OUDS iOS)