Stop using GITHUB_TOKEN/GITEA_TOKEN fallbacks in prepare/do-release/publish mutation paths. Require explicit PAT wiring via secrets.RELEASE_PAT for commit/push/tag and release update operations so downstream workflows trigger reliably.
Add two focused subdirectory composite actions:
- prepare/action.yml: downloads the vociferate binary, runs it to update
changelog and release-version, then commits, tags, and pushes — replacing
the boilerplate git steps consumers previously had to write inline.
- publish/action.yml: extracts the matching changelog section and creates or
updates the Gitea/GitHub release. Outputs release-id, tag, and version so
consumers can upload their own assets after it runs.
Simplify the vociferate workflows to use ./prepare and ./publish directly,
validating both actions in the self-release pipeline.
Update README to show the clean two-action usage pattern.
