Play Framework

docs(deploy): switch tag style to annotated+signed

Repo .git/config has tag.gpgsign=true and tag.forceSignAnnotated=true,
which conflicts with the prior "lightweight tags" guidance — every
git tag invocation under that config attempts signing and lightweight
tags can't be signed. Update step 5 to match: git tag -s with a
"Play Framework v{VERSION}" message, head-check via rev-parse
^{commit} so peeling-to-commit works for annotated comparisons, and
ls-remote verification filters out the peeled `^{}` entries so we
compare tag-object SHAs across remotes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>