Validate release versions before tagging

docs/release.md

@@ -80,12 +80,18 @@ release note, command history, or repository file.
 
 Fetch current remote references, then run this guard without editing the
 candidate. It requires `main`, a clean worktree and index, disabled workspace
-use, the recorded and pushed commit, a matching note, and unused local and
-remote tags:
+use, a stable release version, the recorded and pushed commit, a matching note,
+and unused local and remote tags:
 
 ```sh
 git fetch origin main --tags
 
+if ! printf '%s\n' "$RELEASE_VERSION" |
+  grep -E -x 'v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)' >/dev/null
+then
+  printf '%s\n' "invalid release version: $RELEASE_VERSION" >&2
+  exit 1
+fi
 test "$GOWORK" = off
 test "$(git branch --show-current)" = main
 test -z "$(git status --porcelain)"