feat: add semvertag tag --dry-run flag

[lesnik512]

Summary

• Adds --dry-run to semvertag tag. When set, the use case computes the bump and emits an informative result (status="dry_run" with bump and tag populated) but never calls provider.create_tag.
• New status dry_run joins the existing well-known RunResult.status values (created, no_tags, already_tagged, strategy-specific no_*_commit). RunResult.status is already plain str; no type widening.
• Human-readable output renders dry-run as: Dry run: would create tag {tag} on commit {short} (strategy: {strategy}, bump: {bump}).

Spec: planning/specs/2026-06-09-dry-run-flag-design.md.

Motivation

PR #14 surfaced a structural issue with action-smoke: it ran semvertag with contents: write against the real main, and when main's HEAD wasn't already tagged, semvertag pushed a real release tag (0.4.1) from a PR's CI run. --dry-run is the first half of the fix; the follow-up PR (PR B) will land an action.yml dry-run input, update action-smoke to use it, and bump the version floor.

Test plan

• Unit tests for the dry-run use-case path (status, output, no create_tag call)
• Unit tests that dry-run does NOT affect the other early-return paths (already_tagged, no_tags, strategy no_*_commit)
• Integration test for semvertag tag --dry-run --json against a fake GitLab transport — asserts no POST to /repository/tags
• Unit test for the new _format_result dry_run branch
• 100% branch coverage (fail_under = 100 in pyproject.toml)
• just lint-ci passes

Post-merge follow-ups (NOT in this PR)

1. Cut release 0.5.0 (this is a minor — new CLI feature) via the dogfood workflow. tag-major.yml will float v0. publish.yml will push to PyPI on the GitHub release.
2. Open PR B: action.yml adds a dry-run input; ci.yml's action-smoke job sets with: { dry-run: true }, drops permissions: contents: write, and switches its assertion to "outputs are well-formed AND status != created". Bumps semvertag floor in action.yml from >=0.3.1,<1 to >=0.5.0,<1.

🤖 Generated with Claude Code