Does the GCM authentication tag need to be protected?
The GCM authentication tag doesn't need to be encrypted. Just attach it to the ciphertext in the clear.

A very quick intuitive justification:


It's an authentication tag derived from the ciphertext, it doesn't contain any sensitive information itself.
The security of the GCM model assumes the tag is left in the open. (The GCM spec, SP 800-38D, shows the auth tag output in the clear, see section 7.1.)