feat: tag and publish a Gitea release on every push to master

Replicate the dsh-facet release stack: a Gitea Actions workflow
(.gitea/workflows/release.yml) + .gitea/scripts/release.sh read the commit
subjects since the last tag, bump package.json, prepend CHANGELOG.md, tag
vX.Y.Z and publish the release via API. Agreed install ref is
#semver:^0.1.0, and tags are what 'dsh plugin --profile web update' moves
to, so the workflow is what makes updates work. Add the release.test.sh
suite (43 checks), npm scripts (test:release / release:plan /
release:notes), AGENTS.md with the commit conventions, CHANGELOG.md seed,
and the README *Releases* rules.

README.md

@@ -94,6 +94,50 @@ All fields are optional. Override them in your profile's `cordis.patch.yml` (or
 | `symlinkNames` | `[google-chrome-stable, chromium]` | Link names to create. `google-chrome-stable` is the one ego-browser's PATH scan and its `--no-sandbox` wrapper both check. |
 | `installTimeoutMs` | `600000` | Max time for the background install before it is killed. |
 
+## Releases
+
+`master` releases itself. Every push runs `.gitea/workflows/release.yml`
+(Gitea Actions), which reads the commit subjects since the last tag, bumps
+`package.json`, prepends `CHANGELOG.md`, tags `vX.Y.Z`, and publishes the Gitea
+release with those subjects as the body. The tag is what `dsh plugin --profile
+web update` moves to via the `#semver:^0.1.0` install ref — no tags, no update,
+which is why this workflow exists.
+
+### Commit subjects are release input
+
+| Subject | Bump | Notes section |
+|---|---|---|
+| `feat: …` | minor | **Added** |
+| `feat!: …`, `fix(x)!: …`, `BREAKING`, or `[major]` | major | **Breaking** |
+| `fix: …`, `perf: …`, `revert: …` | patch | **Fixed** |
+| `docs: …` | patch | **Documented** |
+| plain sentence / anything else | patch | **Other** (or flat list) |
+| `[skip release]` | — | nothing published |
+
+`feat` counts only as its own word, so `Fix the feature flag leak` is a patch.
+`[minor]` raises a patch subject to a minor without a `feat`. Only the subject
+line is read.
+
+### First release
+
+With no tags yet, the released version is the one declared in `package.json`
+(currently `v0.1.0`) — the first tag matches what the code says, and every later
+release moves forward from it.
+
+### Manual run
+
+`workflow_dispatch` is enabled for the first release (no tags yet) and for a
+release whose push failed after the tag was created; trigger it from the
+Actions tab.
+
+### Checking before pushing
+
+```sh
+npm run release:plan     # would this HEAD release? (yes/no)
+npm run release:notes    # the exact notes it would publish
+npm run test:release     # the checks behind the bump and the notes
+```
+
 ## Behaviour notes
 
 - **No-clobber links:** a link whose target lives inside the Playwright cache is treated as ours and refreshed to the newest installed revision; any other existing file/symlink is left untouched (and wins).