Make the tagged-release path work on Gitea (closes #65)

No tag could be cut at all: .goreleaser.yaml had no gitea_urls block, so
goreleaser defaulted to the GitHub API, and the repo has zero tags.

.goreleaser.yaml now points at git.eeqj.de. Version derives from git via
a new script/version - exact tag with any leading v stripped, else
dev-<12-char sha>, with a -dirty suffix when tracked files are modified -
replacing the hardcoded 1.0.0-rc.1 that every local build was stamping
regardless of git state. A tag-triggered .gitea/workflows/release.yml
runs goreleaser with a scoped token (RELEASE_TOKEN); script/bootstrap
installs a sha256-verified goreleaser, and make release / release-snapshot
become script shims like every other target.

Two fabrications were removed rather than merely replaced. goreleaser's
snapshot.version_template was `{{ incpatch .Version }}-next`, which
invents a release number from the last tag - and with no tags, from
goreleaser's own fabricated v0.0.0. And internal/cli/version.go gated its
development-build notice on Version == "dev" exactly, so the moment
untagged builds carried a sha that notice would have gone silent and an
unreleased binary would have read as a release. Replaced with a tested
IsDevVersion predicate, and closed at both layers: the Makefile now
refuses to build when script/version yields nothing, and an empty version
counts as a development build - reachable today via
`docker build --build-arg VERSION=`.

The release workflow installs Go from a sha-pinned actions/setup-go
(v5.6.0) using go-version-file, so the compiler that produces released
binaries is pinned like every other external reference. Without it the
first tag push would either fail at goreleaser's before-hook or compile
the published artifacts with whatever unpinned Go the runner happened to
carry - the one unpinned thing in a release path that already refuses an
unpinned goreleaser.

Known gap: the Go tarball setup-go fetches is version-pinned but not
checksum-verified against a value in this repo, unlike the goreleaser
install and the Dockerfile digest.

README.md

@@ -606,6 +606,19 @@ them. We provide:
   `script/bootstrap`, then `script/install-precommit`
 * `script/projectname` — print the project name (used for the Docker
   image tag)
+* `script/version` — print the version string to bake into the binary.
+  The `Makefile`'s `LDFLAGS` call this; it is the single source of truth
+  for the version. See [releasing](#releasing) for the rules.
+* `script/install-goreleaser` — install the pinned `goreleaser` into
+  `.tool/bin` from a sha256-verified release archive. Idempotent, and
+  called by `script/bootstrap`; the release workflow calls it directly
+  because it needs `goreleaser` but not the Docker daemon
+  `script/bootstrap` insists on.
+* `script/release` — cross-compile and publish the release artifacts
+  with the pinned `goreleaser`. Refuses a `goreleaser` on `PATH` whose
+  version is not the pinned one, on the same reasoning as `script/lint`.
+* `script/release-snapshot` — the same build with no publishing and no
+  tagging, into `./dist`
 * `script/test` — run the test suite (verbose rerun on failure). This
   runs *everything*: there is no separate integration target and no
   build-tagged subset held back, so the full round-trip tests in
@@ -669,6 +682,78 @@ them. We provide:
 * `script/install-precommit` — install the git pre-commit hook that
   runs `script/precommit`
 
+## releasing
+
+### version numbers
+
+The version a binary reports comes from git, not from a constant in a
+file. `script/version` decides it, and everything that stamps a binary
+agrees with it:
+
+* `HEAD` is exactly on a tag → that tag with a leading `v` stripped, so
+  the tag `v1.0.0` produces `vaultik 1.0.0`, matching the archive name
+  `vaultik_1.0.0_linux_amd64.tar.gz`. `goreleaser` strips the prefix the
+  same way.
+* anything else → `dev-<12 chars of the commit sha>`.
+* either, with uncommitted changes to tracked files → a `-dirty`
+  suffix, because a modified checkout of a tag is not that tag.
+
+A build that is not a release never names itself like one. `vaultik
+version` says so in as many words on a development build, and
+`goreleaser --snapshot` stamps the same `dev-<sha>` string rather than
+inventing the next patch number. If `script/version` cannot be run at
+all, `make` stops with an error instead of building an unversioned
+binary, and a binary that somehow carries an empty version string still
+reports itself as a development build.
+
+### cutting a release
+
+Releases are cut by CI from a tag, not from a workstation:
+
+```
+git tag -a v1.2.3 -m 'v1.2.3'
+git push origin v1.2.3
+```
+
+`.gitea/workflows/release.yml` triggers on `v*` tags, installs a Go
+toolchain and the pinned `goreleaser`, and runs `script/release`, which
+builds
+`linux,darwin × amd64,arm64` archives plus `checksums.txt` and publishes
+them to this repository's Gitea releases as a draft. `.goreleaser.yaml`
+has a `gitea_urls:` block pointing at `https://git.eeqj.de/api/v1`;
+without it `goreleaser` would talk to the GitHub API.
+
+The workflow needs one repository Actions secret:
+
+| Secret          | What it is                                                                                              |
+| --------------- | ------------------------------------------------------------------------------------------------------- |
+| `RELEASE_TOKEN` | A Gitea access token with `write:repository` scope, owned by an account that can publish releases here. |
+
+It is passed to `goreleaser` as `GITEA_TOKEN`. The runner's automatic
+token is deliberately not used: it is not guaranteed to carry release
+write access.
+
+The Go toolchain that compiles the released binaries comes from an
+`actions/setup-go` step pinned by commit sha, reading its version from
+`go.mod` (currently `1.26.1`, the same version the `Dockerfile` builder
+stage pins by digest). `goreleaser` shells out to `go` for every
+cross-compile, so without that step the release would either fail
+outright or ship binaries built by whatever unpinned toolchain the
+runner happened to carry — the one unpinned thing in an otherwise
+hash-pinned release path.
+
+To rehearse the whole build without publishing or tagging anything:
+
+```
+make release-snapshot
+```
+
+Artifacts land in `./dist`, which is gitignored.
+
+Release artifacts are not signed, carry no SBOM, and are not built
+reproducibly; the archives contain the binary, `LICENSE`, and
+`README.md` only (no shell completions or man page).
+
 ## license
 
 [MIT](https://opensource.org/license/mit/)