feat(release): add Gitea release-publishing pipeline

- Add scripts/build-release.sh: cross-compile linux+windows amd64 with
  ldflags injecting main.version and main.commit, write
  checksums-sha256.txt and release-manifest.json (full commit SHA).
- Add scripts/release-check.sh: local mirror of CI (test, vet, build,
  --version substring check); falls back to Windows artifact when run
  on a Windows host where the Linux binary can't exec.
- Wire main.version / main.commit -> cmd.SetVersionInfo. Default to
  "dev" / "" so local builds without ldflags still produce a
  sensible string. Output format: single line
  'ctask <version> (<short-sha>)' or 'ctask <version>' / 'ctask dev'.
- Add .gitea/workflows/release.yml: triggered on v* tags, runs-on
  ctask-release (golang:1.26-bookworm). Tag parsed from gitea.ref
  (not gitea.ref_name). Pure shell + Gitea API; no actions/checkout,
  no setup-go, no third-party release action. Installs jq at job
  start. RC tags are deletable+recreatable; final tags are immutable.
  Verify step downloads published assets, sha256sum -c's, and runs
  --version.
- notes.md: log Phase 0/2/3 + version-injection completion.

cmd/root.go

@@ -6,7 +6,17 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var version = "0.6.0"
+// version and commit hold the values injected at release build time
+// (via `-ldflags -X main.version=... -X main.commit=...` propagated through
+// SetVersionInfo) or the defaults below for local development builds.
+//
+// `version` is the release tag verbatim (e.g. "v0.6.1-rc.1"). For dev
+// builds it is the literal "dev". `commit` is the full git SHA at build
+// time, or empty when not injected.
+var (
+	version = "dev"
+	commit  = ""
+)
 
 var rootCmd = &cobra.Command{
 	Use:   "ctask",
@@ -18,7 +28,40 @@ func Execute() error {
 	return rootCmd.Execute()
 }
 
-func init() {
-	rootCmd.Version = version
-	rootCmd.SetVersionTemplate(fmt.Sprintf("ctask v%s\n", version))
+// SetVersionInfo is called from main() before Execute() to forward the
+// build-time-injected version and commit into the cmd package. Pass empty
+// strings to keep the package defaults.
+func SetVersionInfo(v, c string) {
+	if v != "" {
+		version = v
+	}
+	if c != "" {
+		commit = c
+	}
+	applyVersionTemplate()
+}
+
+// applyVersionTemplate rebuilds Cobra's --version output from the current
+// version/commit values. Format:
+//
+//	ctask v0.6.1-rc.1 (abcdef1)   // tagged build, commit known
+//	ctask v0.6.1-rc.1             // tagged build, no commit injected
+//	ctask dev                     // local build
+func applyVersionTemplate() {
+	rootCmd.Version = version
+	var line string
+	if commit != "" {
+		short := commit
+		if len(short) > 7 {
+			short = short[:7]
+		}
+		line = fmt.Sprintf("ctask %s (%s)\n", version, short)
+	} else {
+		line = fmt.Sprintf("ctask %s\n", version)
+	}
+	rootCmd.SetVersionTemplate(line)
+}
+
+func init() {
+	applyVersionTemplate()
 }