Clarify some of the tagging notes

[funnelfiasco]

nit: I infer the git tag will follow the date schema? Directly or will it use the v convention to avoid starting with a digit?

Originally posted by @puerco in https://github.com/ossf/security-baseline/pull/412#discussion_r2437790225

Opening this for myself since I'll be AFK for a week.