refactor(release): rename workflows and align update-release path

Rename the reusable workflows to release.yml and update-release.yml,
add UPX compression for release binaries, and sync the standalone
update-release workflow with the active release pipeline fixes.
Update README, AGENTS, compliance notes, and changelog references to
match the new workflow names and usage patterns.

.gitea/workflows/release.yml

@@ -1,4 +1,4 @@
-name: Prepare Release
+name: Release
 
 on:
   workflow_dispatch:
@@ -24,7 +24,7 @@ jobs:
       run:
         shell: bash
     env:
-      SUMMARY_FILE: ${{ runner.temp }}/prepare-release-summary.md
+      SUMMARY_FILE: ${{ runner.temp }}/release-prepare-summary.md
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -39,6 +39,12 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
+      - name: Install release build tools
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y upx-ucl || apt-get install -y upx
+
       - name: Validate formatting
         run: test -z "$(gofmt -l .)"
 
@@ -242,6 +248,15 @@ jobs:
         run: |
           set -euo pipefail
 
+          if command -v upx >/dev/null 2>&1; then
+            upx_cmd=upx
+          elif command -v upx-ucl >/dev/null 2>&1; then
+            upx_cmd=upx-ucl
+          else
+            echo "UPX is not available on PATH after installation." >&2
+            exit 1
+          fi
+
           mkdir -p dist
 
           for target in linux/amd64 linux/arm64; do
@@ -250,6 +265,7 @@ jobs:
 
             bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
             GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
+            "${upx_cmd}" --best --lzma "dist/${bin}"
           done
 
           (
@@ -329,6 +345,7 @@ jobs:
               echo "- Tag: ${TAG_NAME}"
               echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
               echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
+              echo "- Release binaries were compressed with UPX before upload."
             } >> "$SUMMARY_FILE"
           else
             {

.gitea/workflows/update-release.yml

@@ -1,4 +1,4 @@
-name: Do Release
+name: Update Release
 
 on:
   push:
@@ -29,7 +29,7 @@ jobs:
         shell: bash
     env:
       RELEASE_TOKEN: ${{ secrets.RELEASE_PAT }}
-      SUMMARY_FILE: ${{ runner.temp }}/do-release-summary.md
+      SUMMARY_FILE: ${{ runner.temp }}/update-release-summary.md
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -59,7 +59,6 @@ jobs:
         id: resolve-version
         env:
           INPUT_TAG: ${{ inputs.tag }}
-          CALLER_TAG: ${{ needs.prepare.outputs.tag }}
           DETECTED_TAG: ${{ steps.detect-tag.outputs.detected_tag }}
         run: |
           set -euo pipefail
@@ -79,16 +78,10 @@ jobs:
           }
 
           input_tag="$(normalize_candidate "${INPUT_TAG}")"
-          caller_tag="$(normalize_candidate "${CALLER_TAG}")"
           detected_tag="$(normalize_candidate "${DETECTED_TAG}")"
 
           # Try explicit input first.
           requested_tag="$input_tag"
-
-          # Fall back to caller workflow output when workflow_call input forwarding is unreliable.
-          if [[ -z "$requested_tag" && -n "$caller_tag" ]]; then
-            requested_tag="$caller_tag"
-          fi
           
           # Fall back to detected tag if neither input nor caller tag is available.
           if [[ -z "$requested_tag" && -n "$detected_tag" ]]; then
@@ -107,7 +100,6 @@ jobs:
           else
             echo "Error: Could not resolve release version" >&2
             echo "  - inputs.tag(raw): '$INPUT_TAG'" >&2
-            echo "  - needs.prepare.outputs.tag(raw): '$CALLER_TAG'" >&2
             echo "  - detected_tag(raw): '${DETECTED_TAG}'" >&2
             echo "  - GITHUB_REF: '$GITHUB_REF'" >&2
             exit 1
@@ -130,6 +122,12 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
+      - name: Install release build tools
+        run: |
+          set -euo pipefail
+          apt-get update
+          apt-get install -y upx-ucl || apt-get install -y upx
+
       - name: Preflight release API access
         env:
           TAG_NAME: ${{ steps.resolve-version.outputs.tag }}
@@ -172,6 +170,15 @@ jobs:
         run: |
           set -euo pipefail
 
+          if command -v upx >/dev/null 2>&1; then
+            upx_cmd=upx
+          elif command -v upx-ucl >/dev/null 2>&1; then
+            upx_cmd=upx-ucl
+          else
+            echo "UPX is not available on PATH after installation." >&2
+            exit 1
+          fi
+
           mkdir -p dist
 
           for target in linux/amd64 linux/arm64; do
@@ -180,6 +187,7 @@ jobs:
 
             bin="vociferate_${RELEASE_VERSION}_${os}_${arch}"
             GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags="-s -w" -o "dist/${bin}" ./cmd/vociferate
+            "${upx_cmd}" --best --lzma "dist/${bin}"
           done
 
           (
@@ -194,7 +202,27 @@ jobs:
         run: |
           set -euo pipefail
 
-          release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}/assets"
+          raw_release_id="$(printf '%s' "${RELEASE_ID:-}" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
+          if [[ "$raw_release_id" =~ ^%\!t\(string=(.*)\)$ ]]; then
+            raw_release_id="${BASH_REMATCH[1]}"
+          fi
+
+          release_id="$(printf '%s' "$raw_release_id" | sed 's/^[[:space:]]\+//; s/[[:space:]]\+$//')"
+          if ! [[ "$release_id" =~ ^[0-9]+$ ]]; then
+            echo "Invalid release id from publish step: '${RELEASE_ID}'" >&2
+            exit 1
+          fi
+
+          release_detail_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${release_id}"
+          if ! curl --fail-with-body -sS \
+            -H "Authorization: token ${RELEASE_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "$release_detail_api" >/dev/null; then
+            echo "Resolved release endpoint is not accessible: ${release_detail_api}" >&2
+            exit 1
+          fi
+
+          release_api="${GITHUB_API_URL:-${GITHUB_SERVER_URL%/}/api/v1}/repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets"
 
           for asset in dist/*; do
             name="$(basename "$asset")"
@@ -223,25 +251,32 @@ jobs:
               --data-binary "@${asset}"
           done
 
-      - name: Summarize published release
+      - name: Summary
+        if: ${{ always() }}
         env:
           TAG_NAME: ${{ steps.publish.outputs.tag }}
           RELEASE_VERSION: ${{ steps.publish.outputs.version }}
+          PUBLISH_OUTCOME: ${{ steps.publish.outcome }}
         run: |
           set -euo pipefail
 
-          {
-            echo "## Release Published"
-            echo
-            echo "- Tag: ${TAG_NAME}"
-            echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
-            echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
-          } >> "$SUMMARY_FILE"
-
-      - name: Summary
-        if: ${{ always() }}
-        run: |
-          set -euo pipefail
+          if [[ "${PUBLISH_OUTCOME}" == "success" ]]; then
+            {
+              echo "## Release Published"
+              echo
+              echo "- Tag: ${TAG_NAME}"
+              echo "- Release notes sourced from changelog entry ${RELEASE_VERSION}."
+              echo "- Published assets: vociferate_${RELEASE_VERSION}_linux_amd64, vociferate_${RELEASE_VERSION}_linux_arm64, checksums.txt"
+              echo "- Release binaries were compressed with UPX before upload."
+            } >> "$SUMMARY_FILE"
+          else
+            {
+              echo "## Release Failed"
+              echo
+              echo "- Tag: ${TAG_NAME:-unknown}"
+              echo "- Create or update release step did not complete successfully."
+            } >> "$SUMMARY_FILE"
+          fi
 
           echo 'Summary'
           echo
@@ -268,7 +303,7 @@ jobs:
       run:
         shell: bash
     env:
-      SUMMARY_FILE: ${{ runner.temp }}/do-release-validate-summary.md
+      SUMMARY_FILE: ${{ runner.temp }}/update-release-validate-summary.md
     steps:
       - name: Checkout tagged revision
         uses: actions/checkout@v4