feat(release): add Gitea release-publishing pipeline

- Add scripts/build-release.sh: cross-compile linux+windows amd64 with
  ldflags injecting main.version and main.commit, write
  checksums-sha256.txt and release-manifest.json (full commit SHA).
- Add scripts/release-check.sh: local mirror of CI (test, vet, build,
  --version substring check); falls back to Windows artifact when run
  on a Windows host where the Linux binary can't exec.
- Wire main.version / main.commit -> cmd.SetVersionInfo. Default to
  "dev" / "" so local builds without ldflags still produce a
  sensible string. Output format: single line
  'ctask <version> (<short-sha>)' or 'ctask <version>' / 'ctask dev'.
- Add .gitea/workflows/release.yml: triggered on v* tags, runs-on
  ctask-release (golang:1.26-bookworm). Tag parsed from gitea.ref
  (not gitea.ref_name). Pure shell + Gitea API; no actions/checkout,
  no setup-go, no third-party release action. Installs jq at job
  start. RC tags are deletable+recreatable; final tags are immutable.
  Verify step downloads published assets, sha256sum -c's, and runs
  --version.
- notes.md: log Phase 0/2/3 + version-injection completion.

scripts/release-check.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# release-check.sh — local mirror of the CI release pipeline.
+#
+# Runs the same gates the Gitea Actions workflow runs (tests, vet, build)
+# so a release is locally validated before any tag is pushed. The final
+# step prints the binary's --version so the operator can confirm the
+# build-time-injected version string matches the tag.
+#
+# Usage:
+#   bash scripts/release-check.sh <version>
+#
+# Example:
+#   bash scripts/release-check.sh v0.6.1-rc.1
+set -euo pipefail
+
+VERSION="${1:?Usage: release-check.sh <version>}"
+
+echo "=== Running tests ==="
+go test ./...
+
+echo ""
+echo "=== Running go vet ==="
+go vet ./...
+
+echo ""
+echo "=== Building release artifacts ==="
+bash "$(dirname "$0")/build-release.sh" "${VERSION}"
+
+echo ""
+echo "=== Verifying version output ==="
+REPORTED="$(./dist/ctask-linux-amd64 --version 2>/dev/null || true)"
+if [ -z "${REPORTED}" ]; then
+  # Linux binary won't run natively on Windows — fall back to the
+  # Windows artifact so this script remains useful on the workstation.
+  REPORTED="$(./dist/ctask-windows-amd64.exe --version)"
+  echo "Binary reports (windows-amd64): ${REPORTED}"
+else
+  echo "Binary reports (linux-amd64):   ${REPORTED}"
+fi
+
+# Soft-assert the version is present in the reported string. The CI
+# workflow's Verify-download step performs the same check.
+if ! echo "${REPORTED}" | grep -qF "${VERSION}"; then
+  echo "ERROR: --version output does not contain ${VERSION}" >&2
+  exit 1
+fi
+
+echo ""
+echo "release-check OK for ${VERSION}"