feat: add prepare and publish composite actions

Add two focused subdirectory composite actions:

- prepare/action.yml: downloads the vociferate binary, runs it to update
  changelog and release-version, then commits, tags, and pushes — replacing
  the boilerplate git steps consumers previously had to write inline.

- publish/action.yml: extracts the matching changelog section and creates or
  updates the Gitea/GitHub release. Outputs release-id, tag, and version so
  consumers can upload their own assets after it runs.

Simplify the vociferate workflows to use ./prepare and ./publish directly,
validating both actions in the self-release pipeline.

Update README to show the clean two-action usage pattern.

.gitea/workflows/do-release.yml

@@ -22,8 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     container: docker.io/catthehacker/ubuntu:act-latest
     outputs:
-      tag: ${{ steps.resolve-tag.outputs.tag }}
-      version: ${{ steps.resolve-tag.outputs.version }}
+      tag: ${{ steps.publish.outputs.tag }}
+      version: ${{ steps.publish.outputs.version }}
     defaults:
       run:
         shell: bash
@@ -36,35 +36,12 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.ref }}
 
-      - name: Resolve release tag
-        id: resolve-tag
-        env:
-          INPUT_TAG: ${{ inputs.tag }}
-          GITHUB_REF_VALUE: ${{ github.ref }}
-        run: |
-          set -euo pipefail
-
-          provided_tag="$(printf '%s' "${INPUT_TAG:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
-          if [[ -n "$provided_tag" ]]; then
-            normalized_version="${provided_tag#v}"
-            tag="v${normalized_version}"
-          elif [[ "${GITHUB_REF_VALUE}" == refs/tags/* ]]; then
-            tag="${GITHUB_REF_VALUE#refs/tags/}"
-            normalized_version="${tag#v}"
-          else
-            echo "A tag input is required when the workflow is not running from a tag push" >&2
-            exit 1
-          fi
-
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-          echo "version=$normalized_version" >> "$GITHUB_OUTPUT"
-
       - name: Checkout requested tag
         if: ${{ inputs.tag != '' }}
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: refs/tags/${{ steps.resolve-tag.outputs.tag }}
+          ref: ${{ startsWith(inputs.tag, 'v') && format('refs/tags/{0}', inputs.tag) || format('refs/tags/v{0}', inputs.tag) }}
 
       - name: Setup Go
         uses: actions/setup-go@v5
@@ -74,90 +51,16 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Extract release notes from changelog
-        id: release-notes
-        env:
-          RELEASE_VERSION: ${{ steps.resolve-tag.outputs.version }}
-        run: |
-          set -euo pipefail
-
-          release_notes="$(awk -v version="$RELEASE_VERSION" '
-            $0 ~ "^## \\[" version "\\] - " {capture=1}
-            capture {
-              if ($0 ~ "^## \\[" && $0 !~ "^## \\[" version "\\] - ") exit
-              print
-            }
-          ' changelog.md)"
-
-          if [[ -z "${release_notes//[[:space:]]/}" ]]; then
-            echo "Release notes section for ${RELEASE_VERSION} was not found in changelog.md" >&2
-            exit 1
-          fi
-
-          notes_file="$RUNNER_TEMP/release-notes.md"
-          printf '%s\n' "$release_notes" > "$notes_file"
-
-          echo "notes_file=$notes_file" >> "$GITHUB_OUTPUT"
-
       - name: Create or update release
-        id: release
-        env:
-          TAG_NAME: ${{ steps.resolve-tag.outputs.tag }}
-          RELEASE_NOTES_FILE: ${{ steps.release-notes.outputs.notes_file }}
-        run: |
-          set -euo pipefail
-
-          release_notes="$(cat "$RELEASE_NOTES_FILE")"
-          escaped_release_notes="$(printf '%s' "$release_notes" | sed 's/\\/\\\\/g; s/"/\\"/g; :a;N;$!ba;s/\n/\\n/g')"
-          release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases"
-          release_by_tag_api="${release_api}/tags/${TAG_NAME}"
-
-          status_code="$(curl -sS -o release-existing.json -w '%{http_code}' \
-            -H "Authorization: token ${RELEASE_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${release_by_tag_api}")"
-
-          if [[ "$status_code" == "200" ]]; then
-            existing_release_id="$(sed -n 's/.*"id"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' release-existing.json | head -n 1)"
-            if [[ -z "$existing_release_id" ]]; then
-              echo "Failed to parse existing release id for ${TAG_NAME}" >&2
-              cat release-existing.json >&2
-              exit 1
-            fi
-
-            curl --fail-with-body \
-              -X PATCH \
-              -H "Authorization: token ${RELEASE_TOKEN}" \
-              -H "Content-Type: application/json" \
-              "${release_api}/${existing_release_id}" \
-              --data "{\"tag_name\":\"${TAG_NAME}\",\"target\":\"${GITHUB_SHA}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
-              --output release.json
-          elif [[ "$status_code" != "404" ]]; then
-            echo "Unexpected response while checking release ${TAG_NAME}: HTTP ${status_code}" >&2
-            cat release-existing.json >&2
-            exit 1
-          else
-            curl --fail-with-body \
-              -X POST \
-              -H "Authorization: token ${RELEASE_TOKEN}" \
-              -H "Content-Type: application/json" \
-              "${release_api}" \
-              --data "{\"tag_name\":\"${TAG_NAME}\",\"target\":\"${GITHUB_SHA}\",\"name\":\"${TAG_NAME}\",\"body\":\"${escaped_release_notes}\",\"draft\":false,\"prerelease\":false}" \
-              --output release.json
-          fi
-
-          release_id="$(sed -n 's/.*"id"[[:space:]]*:[[:space:]]*\([0-9][0-9]*\).*/\1/p' release.json | head -n 1)"
-          if [[ -z "$release_id" ]]; then
-            echo "Failed to parse release id from API response" >&2
-            cat release.json >&2
-            exit 1
-          fi
-
-          echo "id=$release_id" >> "$GITHUB_OUTPUT"
+        id: publish
+        uses: ./publish
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          version: ${{ inputs.tag }}
 
       - name: Build release binaries
         env:
-          RELEASE_VERSION: ${{ steps.resolve-tag.outputs.version }}
+          RELEASE_VERSION: ${{ steps.publish.outputs.version }}
         run: |
           set -euo pipefail
 
@@ -178,7 +81,8 @@ jobs:
 
       - name: Upload release binaries
         env:
-          RELEASE_ID: ${{ steps.release.outputs.id }}
+          RELEASE_ID: ${{ steps.publish.outputs.release-id }}
+          RELEASE_VERSION: ${{ steps.publish.outputs.version }}
         run: |
           set -euo pipefail
 
@@ -213,8 +117,8 @@ jobs:
 
       - name: Summarize published release
         env:
-          TAG_NAME: ${{ steps.resolve-tag.outputs.tag }}
-          RELEASE_VERSION: ${{ steps.resolve-tag.outputs.version }}
+          TAG_NAME: ${{ steps.publish.outputs.tag }}
+          RELEASE_VERSION: ${{ steps.publish.outputs.version }}
         run: |
           set -euo pipefail