phase 10: release pipeline (Gitea release on v* tag)

P9 resolved (SPEC §11): stay manual. CI builds the four Linux targets
via cross; macOS + Windows binaries are produced ad hoc by maintainers
and uploaded to the same Gitea release.

§8.2/§8.4 updated: crates.io publish is deferred for now (workflow
ships the Gitea release only; can be re-enabled with a one-line
`cargo publish -p nuwiki-core` job once we're ready to publish). The
CARGO_REGISTRY_TOKEN row in §8.4 is struck through accordingly.

release.yaml:

- Trigger: `push` on tags matching `v*`.
- build matrix (4 jobs): x86_64/aarch64 × gnu/musl. Each pins
  Rust 1.83, caches `~/.cargo/{bin,registry,git}` + `target` keyed
  on target + Cargo.lock hash, installs `cross 0.2.5` if not in
  cache, runs `cross build --release -p nuwiki-ls`, packages as
  `nuwiki-ls-{version}-{target}.tar.gz`, uploads as an artifact.
- release job: `needs: build`. Downloads all build artifacts via
  download-artifact@v4 with `merge-multiple: true`; installs jq +
  curl if missing; POSTs a release-create payload to
  `/api/v1/repos/$REPO/releases` using `RELEASE_TOKEN`, then streams
  each `.tar.gz` to `/releases/{id}/assets?name=…`. Up-front check
  fails fast if the secret is unset.

README + SPEC top-line status: "All phases (0–10) complete." 172
tests still green locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

SPEC.md

@@ -1,7 +1,7 @@
 # nuwiki — Project Specification
 
 > Last updated: 2026-05-10
-> Status: Phase 9 (Editor Glue) complete — moving to Phase 10 (CI/CD release pipeline)
+> Status: All phases (0–10) complete
 
 ---
 
@@ -449,7 +449,7 @@ require('nuwiki').setup({
 - Cross-compile for all 4 Linux targets using `cross`
 - Package binaries as `.tar.gz`
 - Create Gitea release and upload assets via REST API using `RELEASE_TOKEN` secret
-- Publish `nuwiki-core` to crates.io using `CARGO_REGISTRY_TOKEN` secret
+- crates.io publish is deferred — workflow ships the Gitea release only. Re-enable by adding a `cargo publish -p nuwiki-core` job once the crate is ready for publication.
 
 ### 8.3 Build Targets
 
@@ -468,7 +468,7 @@ require('nuwiki').setup({
 | Secret | Purpose |
 |---|---|
 | `RELEASE_TOKEN` | Gitea personal access token for creating releases and uploading assets |
-| `CARGO_REGISTRY_TOKEN` | crates.io API token for publishing `nuwiki-core` |
+| ~~`CARGO_REGISTRY_TOKEN`~~ | ~~crates.io API token for publishing `nuwiki-core`~~ — deferred (see §8.2) |
 
 ### 8.5 `actions/cache` Configuration
 
@@ -592,5 +592,4 @@ These decisions are required before or during the phase indicated.
 | ~~P6~~ | ~~**Minimum Vim version**~~ | ~~Phase 9~~ | ✅ **Vim 9.1+** | autoload glue assumes 9.1 idioms; uses `vim-lsp` first, then falls back to `coc.nvim`. |
 | ~~P7~~ | ~~**Semantic token type mapping**~~ | ~~Phase 7~~ | ✅ **Custom vimwiki-specific token types** | ~20 types (`vimwikiHeading`, `vimwikiBold`, …) + `level1`..`level6` + `centered` modifiers. Phase 9 ships default highlight groups in `syntax/nuwiki.vim` and the Lua glue. |
 | ~~P8~~ | ~~**Workspace indexing strategy**~~ | ~~Phase 8~~ | ✅ **Lazy + background with progress** | Initial scan runs as a background tokio task; nav features answer with partial data until complete; progress reported via `window/workDoneProgress`. |
-| P9 | **macOS runner** | Phase 10 | Stay manual · Register macOS runner
-| Revisit if a Mac is available; no action needed now |
+| ~~P9~~ | ~~**macOS runner**~~ | ~~Phase 10~~ | ✅ **Stay manual** | Release workflow cross-compiles the 4 Linux targets via `cross`; macOS + Windows binaries are produced ad hoc by maintainers and uploaded to the same Gitea release. Revisit when a Mac runner is available. |