👷 Add Gitea release page to CI

The publish job now opens a Gitea release for the tag, using the
matching Keep-a-Changelog section as the body via scripts/release-notes.sh.
It runs before npm publish so a broken page fails CI without burning an
npm version; npm publish stays the last step.

Uses the first-party gitea-release-action (the older actions/release-action
is deprecated and requires asset files) and contents: write for the run's
automatic token.

.gitea/workflows/ci.yml

@@ -52,6 +52,10 @@ jobs:
         if: startsWith(gitea.ref, 'refs/tags/')
         needs: build
         runs-on: ubuntu-latest
+        # The release page is created with the run's automatic Gitea token
+        # (`github.token`), not `NPM_TOKEN`, so it needs `contents: write`.
+        permissions:
+            contents: write
         steps:
             # Double-gate: publish only runs on a tag *and* aborts here if NPM_TOKEN
             # is unset, so a tag push never silently no-ops (or half-publishes). Set
@@ -76,6 +80,19 @@ jobs:
                   path: dist/
             - run: npm run publish:publint
             - run: npm run publish:attw
+            # The Gitea release page is created *before* `npm publish` on
+            # purpose: a broken page then fails CI without burning an npm
+            # version. The page is cheap to retry, a published version is not.
+            # The body is the matching Keep-a-Changelog section; an unknown tag
+            # makes the extractor exit non-zero, so the page can never go up
+            # empty.
+            - name: Extract release notes from CHANGELOG.md
+              env:
+                  TAG_REF: ${{ gitea.ref }}
+              run: ./scripts/release-notes.sh "${TAG_REF#refs/tags/}" > release-notes.md
+            - uses: https://gitea.com/actions/gitea-release-action@v1
+              with:
+                  body_path: release-notes.md
             - run: npm publish --access public
               env:
                   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}