This way, if the maintainer isn't able to update `main`,
the push doesn't add the shared-VERSION tag either.
That avoids ending up with a tag that potentially doesn't
get included in the history of the main branch.
The Git docs warn that servers might or might not support this
feature, but GitHub does -- indeed they boasted about it when it
first came out, in Git 2.4 back in 2015:
https://github.blog/2015-04-30-git-2-4-atomic-pushes-push-to-deploy-and-more/