Allow tag in git-manager's subcommand allowlist

Tagging a commit doesn't rewrite or discard history/working-tree state,
unlike stash/merge/rebase/reset which stay excluded as a deliberate
guardrail.

skills/git-manager/scripts/_lib.sh

@@ -6,7 +6,7 @@ CONFIG_FILE="$HOME/.agent-skills/git-manager/config.json"
 
 # Subcommands this skill is allowed to run. Anything not in this list is
 # rejected outright by git_cmd.sh, regardless of what the caller asks for.
-ALLOWED_SUBCOMMANDS=(status log diff show fetch remote branch checkout add commit push pull)
+ALLOWED_SUBCOMMANDS=(status log diff show fetch remote branch checkout add commit push pull tag)
 
 is_allowed_subcommand() {
   local sub="$1"