Any "given" name/ID (IE anything but the full hash) in a distributed VCS has to be mutable - without some single central arbiter of truth it's simply impossible.

I'm honestly a little surprised people seem to think they might be immutable - I guess maybe if people see "git" as "Actually Github"?