feat: chain do-release from prepare workflow

- Update prepare-release to call do-release via workflow_call after tag creation.
- Update README examples and release-flow docs to reflect direct invocation
  instead of relying only on tag-push triggers.

.gitea/workflows/prepare-release.yml

@@ -18,6 +18,8 @@ jobs:
   prepare:
     runs-on: ubuntu-latest
     container: docker.io/catthehacker/ubuntu:act-latest
+    outputs:
+      tag: ${{ steps.prepare.outputs.version }}
     defaults:
       run:
         shell: bash
@@ -58,5 +60,12 @@ jobs:
             echo "## Release Prepared"
             echo
             echo "- Tag pushed: ${tag}"
-            echo "- The tag-triggered Do Release workflow will create or update the release and publish binaries."
+            echo "- Calling Do Release workflow for ${tag}."
           } >> "$GITHUB_STEP_SUMMARY"
+
+  publish:
+    needs: prepare
+    uses: ./.gitea/workflows/do-release.yml
+    with:
+      tag: ${{ needs.prepare.outputs.tag }}
+    secrets: inherit

README.md

@@ -37,6 +37,13 @@ jobs:
       - uses: git.hrafn.xyz/aether/vociferate/prepare@v1.0.0
         with:
           version: ${{ inputs.version }}
+
+  publish:
+    needs: prepare
+    uses: aether/vociferate/.gitea/workflows/do-release.yml@main
+    with:
+      tag: ${{ needs.prepare.outputs.version }}
+    secrets: inherit
 ```
 
 Downloads a prebuilt vociferate binary, runs it to update `changelog.md` and
@@ -63,17 +70,18 @@ so no token input is required.
 name: Do Release
 
 on:
-  push:
+  workflow_dispatch:
-    tags:
+    inputs:
-      - "v*.*.*"
+      tag:
+        description: Semantic version to publish (for example v1.2.3)
+        required: true
 
 jobs:
   release:
-    runs-on: ubuntu-latest
+    uses: aether/vociferate/.gitea/workflows/do-release.yml@main
-    steps:
+    with:
-      - uses: actions/checkout@v4
+      tag: ${{ inputs.tag }}
-
+    secrets: inherit
-      - uses: git.hrafn.xyz/aether/vociferate/publish@v1.0.0
 ```
 
 Reads the matching section from `changelog.md` and creates or updates the
@@ -169,9 +177,10 @@ just go-test
 Releases use two workflows:
 
 - `Prepare Release` runs on demand, updates `release-version` and `changelog.md`, commits those changes back to `main`, and pushes the release tag.
-- `Do Release` runs from the pushed tag, reads the matching changelog section from that tagged revision, creates or updates the release, and uploads prebuilt binaries.
+- `Prepare Release` then calls `Do Release` directly via reusable `workflow_call` with the resolved tag.
+- `Do Release` reads the matching changelog section from that tagged revision, creates or updates the release, and uploads prebuilt binaries.
 
-This split matters because release notes must be generated from the tagged commit that already contains the promoted changelog section.
+Calling `Do Release` directly avoids environments where tag pushes from workflow tokens do not emit a follow-up workflow trigger event.
 
 ## Release Artifacts