Tighten dependencies for tag-related jobs

Tighten dependencies for tag-related jobs

The "merge-tag" and "update-stable-tag" jobs currently use the
"manual_release_job_qa" YAML anchor, which makes them depend on the
"staging" job.  Meanwhile, both of these jobs require the tag they were
created for to be public for them to work.  While this is harmless, as
these jobs will simply fail if they are run too early, it still makes
sense for them to depend on the "publish" job instead, if only to reduce
confusion in the pipeline view.  Adjust the "needs" key for the
"merge-tag" and "update-stable-tag" jobs accordingly.