phase 10: release pipeline (Gitea release on v* tag)

P9 resolved (SPEC §11): stay manual. CI builds the four Linux targets
via cross; macOS + Windows binaries are produced ad hoc by maintainers
and uploaded to the same Gitea release.

§8.2/§8.4 updated: crates.io publish is deferred for now (workflow
ships the Gitea release only; can be re-enabled with a one-line
`cargo publish -p nuwiki-core` job once we're ready to publish). The
CARGO_REGISTRY_TOKEN row in §8.4 is struck through accordingly.

release.yaml:

- Trigger: `push` on tags matching `v*`.
- build matrix (4 jobs): x86_64/aarch64 × gnu/musl. Each pins
  Rust 1.83, caches `~/.cargo/{bin,registry,git}` + `target` keyed
  on target + Cargo.lock hash, installs `cross 0.2.5` if not in
  cache, runs `cross build --release -p nuwiki-ls`, packages as
  `nuwiki-ls-{version}-{target}.tar.gz`, uploads as an artifact.
- release job: `needs: build`. Downloads all build artifacts via
  download-artifact@v4 with `merge-multiple: true`; installs jq +
  curl if missing; POSTs a release-create payload to
  `/api/v1/repos/$REPO/releases` using `RELEASE_TOKEN`, then streams
  each `.tar.gz` to `/releases/{id}/assets?name=…`. Up-front check
  fails fast if the secret is unset.

README + SPEC top-line status: "All phases (0–10) complete." 172
tests still green locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -0,0 +1,134 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: short
+
+jobs:
+  build:
+    name: build ${{ matrix.target }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target:
+          - x86_64-unknown-linux-gnu
+          - aarch64-unknown-linux-gnu
+          - x86_64-unknown-linux-musl
+          - aarch64-unknown-linux-musl
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@1.83
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Cache cargo state
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/bin
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-release-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-release-${{ matrix.target }}-
+
+      - name: Install cross
+        run: |
+          if ! command -v cross >/dev/null 2>&1; then
+            cargo install cross --locked --version 0.2.5
+          fi
+
+      - name: Cross-compile nuwiki-ls
+        run: cross build --release --target ${{ matrix.target }} -p nuwiki-ls
+
+      - name: Package archive
+        id: package
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          archive="nuwiki-ls-${version}-${{ matrix.target }}.tar.gz"
+          tar -czf "$archive" -C "target/${{ matrix.target }}/release" nuwiki-ls
+          echo "archive=$archive" >> "$GITHUB_OUTPUT"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nuwiki-ls-${{ matrix.target }}
+          path: ${{ steps.package.outputs.archive }}
+          if-no-files-found: error
+          retention-days: 7
+
+  release:
+    name: gitea release
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: ./artifacts
+          merge-multiple: true
+
+      - name: Ensure jq + curl
+        run: |
+          if ! command -v jq >/dev/null 2>&1; then
+            apt-get update && apt-get install -y --no-install-recommends jq
+          fi
+          if ! command -v curl >/dev/null 2>&1; then
+            apt-get update && apt-get install -y --no-install-recommends curl
+          fi
+
+      - name: Create Gitea release + upload assets
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GITEA_SERVER: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          if [ -z "${RELEASE_TOKEN:-}" ]; then
+            echo "::error::RELEASE_TOKEN secret is not set"
+            exit 1
+          fi
+          echo "Releasing $TAG to $GITEA_SERVER/$REPO"
+
+          payload=$(jq -n --arg tag "$TAG" --arg name "$TAG" \
+            '{tag_name: $tag, name: $name, draft: false, prerelease: false}')
+
+          release_id=$(curl --fail --silent --show-error \
+            -H "Authorization: token $RELEASE_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "$payload" \
+            "$GITEA_SERVER/api/v1/repos/$REPO/releases" \
+            | jq -r '.id')
+
+          if [ -z "$release_id" ] || [ "$release_id" = "null" ]; then
+            echo "::error::failed to create release"
+            exit 1
+          fi
+          echo "Created release id=$release_id"
+
+          for archive in artifacts/*.tar.gz; do
+            name="$(basename "$archive")"
+            echo "Uploading $name …"
+            curl --fail --silent --show-error \
+              -H "Authorization: token $RELEASE_TOKEN" \
+              -H "Content-Type: application/gzip" \
+              --data-binary "@$archive" \
+              "$GITEA_SERVER/api/v1/repos/$REPO/releases/$release_id/assets?name=$name" \
+              >/dev/null
+          done
+          echo "All assets uploaded."