fix: publish release notes from annotated tag

[frahlg]

Summary

• require annotated release tags in the tag validation step
• read release notes into a file before calling GitHub CLI
• keep the explicit repository target and document the check

Reason

The v0.1.0-alpha.1 workflow passed all checks and both native builds, but its
publish step used an unsupported GitHub CLI flag pair: --notes-from-tag with
--repo. The release was published from the successful workflow artifacts
without changing the tag. This change prevents the same failure on later tags.

Checks

• actionlint 1.7.12
• git diff --check
• annotated-tag type check
• release-note extraction check against v0.1.0-alpha.1

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e92e32afc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid publishing tag signatures as release notes

When a maintainer uses a signed annotated release tag, %(contents) writes the complete tag contents into dist/RELEASE_NOTES.md, including the embedded PGP signature; Git documents contents as the complete message and exposes the signature separately as contents:signature (git-for-each-ref). That means the next signed release would publish a long -----BEGIN PGP SIGNATURE----- block in the GitHub release notes, even though the release policy still allows signed tags; please format the file from the subject/body atoms instead of the full contents.

Useful? React with 👍 / 👎.