ci: make sure the tag being pushed is both annotated and signed

ci: make sure the tag being pushed is both annotated and signed #430