feat(release): add Gitea release-publishing pipeline

- Add scripts/build-release.sh: cross-compile linux+windows amd64 with
  ldflags injecting main.version and main.commit, write
  checksums-sha256.txt and release-manifest.json (full commit SHA).
- Add scripts/release-check.sh: local mirror of CI (test, vet, build,
  --version substring check); falls back to Windows artifact when run
  on a Windows host where the Linux binary can't exec.
- Wire main.version / main.commit -> cmd.SetVersionInfo. Default to
  "dev" / "" so local builds without ldflags still produce a
  sensible string. Output format: single line
  'ctask <version> (<short-sha>)' or 'ctask <version>' / 'ctask dev'.
- Add .gitea/workflows/release.yml: triggered on v* tags, runs-on
  ctask-release (golang:1.26-bookworm). Tag parsed from gitea.ref
  (not gitea.ref_name). Pure shell + Gitea API; no actions/checkout,
  no setup-go, no third-party release action. Installs jq at job
  start. RC tags are deletable+recreatable; final tags are immutable.
  Verify step downloads published assets, sha256sum -c's, and runs
  --version.
- notes.md: log Phase 0/2/3 + version-injection completion.

main.go

@@ -7,7 +7,20 @@ import (
 	"github.com/warrenronsiek/ctask/cmd"
 )
 
+// version and commit are populated at release build time via:
+//
+//	go build -ldflags "-X main.version=vX.Y.Z -X main.commit=<git-sha>"
+//
+// Defaults below apply when the binary is built without ldflags (e.g.
+// `go build`, `just install`) so local development still produces a
+// runnable binary whose `--version` output is unambiguous.
+var (
+	version = "dev"
+	commit  = ""
+)
+
 func main() {
+	cmd.SetVersionInfo(version, commit)
 	if err := cmd.Execute(); err != nil {
 		msg := err.Error()
 		// Exit code 127 for agent command not found (per spec)
@@ -21,4 +34,3 @@ func main() {
 		os.Exit(1)
 	}
 }
-