The tag is updated. https://go.googlesource.com/go/+/refs/tags/go1.19.13 points to the right commit now.

The relevant relui logic is as follows:

publishingHead := wf.Task4(wd, "Check branch state matches source archive", build.checkSourceMatch, distpackVal, branchVal, versionFile, source, wf.After(okayToTagAndPublish))
versionCL := wf.Task4(wd, "Mail version CL", version.CreateAutoSubmitVersionCL, branchVal, nextVersion, coordinators, versionFile, wf.After(publishingHead))
tagCommit = wf.Task2(wd, "Wait for version CL submission", version.AwaitCL, versionCL, publishingHead)

(source)

Publishing head was the commit just before the VERSION file. Its tree content is exactly the right content, but VERSION file isn't updated yet.

Then "Mail version CL" tries to mail and wait for a CL to land.

If that task happens result in no CL being mailed (e.g., because tip of the release branch already has the VERSION file updated to its intended content), the AwaitCL will return publishingHead as is.

It should instead make sure that the publishingHead commit contains the intended VERSION file content, and if it doesn't, read the branch head again and see if (or one if its parents) does. Otherwise it's correct for it to fail until the tip of the release branch is corrected.

(It's good that the most amount of deviation between intended tagged commit and actual tagged commit could've been the VERSION file only, and no other file. After fixing this issue, the VERSION file will also be verified and require to match exactly.)