Move the release signing baseline to 3.1.6 and catch lightweight tags in CI

The 3.1.5 tag was created server-side by publishing the GitHub release,
which can only produce a lightweight ref, so it carries no signature and
git verify-tag fails on it. Rather than force-move a published tag, state
that signing starts at 3.1.6 and cut that tag locally with git tag -s
before the release is published.

vtag.yml now fails the run when the pushed tag is not a tag object, so the
same mistake shows up as a red check on the release instead of arriving as
a user report. The mirror step runs first, so v<tag> is still created; its
early "already exists" return became an else branch so the check is never
skipped.

https://github.com/acmesh-official/acme.sh/issues/7273

README.md

@@ -233,7 +233,7 @@ acme.sh -h
 
 #### 🔏 Verify a Release
 
-Release tags from `3.1.5` on are signed with the maintainer's SSH key. The
+Release tags from `3.1.6` on are signed with the maintainer's SSH key. The
 signing happens on the maintainer's machine, so the private key is never
 available to CI. The public half is [`allowed_signers`](allowed_signers) in
 this repository. From a clone:
@@ -243,7 +243,7 @@ git config gpg.ssh.allowedSignersFile allowed_signers
 ```
 
 ```bash
-git verify-tag 3.1.5
+git verify-tag 3.1.6
 ```
 
 The signature covers the tag object, which pins the commit and therefore the
@@ -251,10 +251,10 @@ whole tree, so a good signature verifies every file at that release and no
 separate tarball checksum is needed. Build a tarball from the verified tag:
 
 ```bash
-git archive --format=tar.gz --prefix=acme.sh-3.1.5/ 3.1.5 > acme.sh-3.1.5.tar.gz
+git archive --format=tar.gz --prefix=acme.sh-3.1.6/ 3.1.6 > acme.sh-3.1.6.tar.gz
 ```
 
-> ⚠️ Tags up to `3.1.4` predate the signing key and are unsigned.
+> ⚠️ Tags up to `3.1.5` are unsigned.
 
 ---