ci: move bark-notify.sh to .github/scripts, add Gitea release asset upload

Two changes:

1. Move scripts/bark-notify.sh -> .github/scripts/bark-notify.sh
   (CI helper belongs next to the workflow that calls it). History
   preserved via git mv.

2. Add a 'Upload release assets via Gitea API' step that runs only
   on tag pushes (if: startsWith(github.ref, 'refs/tags/v')). It:
     - POSTs /releases to create a Gitea release bound to the tag
     - extracts the release id from the response (with explicit error
       path if the API call fails)
     - loops over dist/snapshot-*.whl and dist/snapshot-*.tar.gz and
       uploads each as a release asset
   Uses ${{ secrets.GITHUB_TOKEN }} exposed as the GITEA_TOKEN env
   var (the Gitea convention for the repo token secret). The
   Notify Bark step still runs last with if: always() so a release
   upload failure is reported via the phone.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/build.yml

@@ -31,6 +31,55 @@ jobs:
           path: dist/snapshot-*
           if-no-files-found: error
 
+      # Only create a release + attach dist/ assets when pushing a v* tag.
+      # On branch pushes / pull requests this step is skipped entirely.
+      - name: Upload release assets via Gitea API
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG_NAME="${{ github.ref_name }}"
+
+          echo "Creating Gitea release for tag ${TAG_NAME}..."
+
+          RELEASE_RESPONSE=$(curl -fsS -X POST "${{ github.api_url }}/repos/${{ github.repository }}/releases" \
+            -H "accept: application/json" \
+            -H "authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "$(cat <<EOF
+{
+  "tag_name": "${TAG_NAME}",
+  "target_commitish": "${{ github.sha }}",
+  "name": "Release ${TAG_NAME}",
+  "body": "Auto-generated release assets.",
+  "draft": false,
+  "prerelease": false
+}
+EOF
+)")
+
+          RELEASE_ID=$(printf '%s' "${RELEASE_RESPONSE}" | grep -oP '"id":\s*\K[0-9]+' | head -n 1)
+          if [ -z "${RELEASE_ID}" ]; then
+            echo "ERROR: failed to create release. Response:"
+            echo "${RELEASE_RESPONSE}"
+            exit 1
+          fi
+          echo "Release created with ID ${RELEASE_ID}"
+
+          for asset in dist/snapshot-*.whl dist/snapshot-*.tar.gz; do
+            if [ -f "${asset}" ]; then
+              echo "Uploading ${asset}..."
+              curl -fsS -X POST "${{ github.api_url }}/repos/${{ github.repository }}/releases/${RELEASE_ID}/assets" \
+                -H "accept: application/json" \
+                -H "authorization: token ${GITEA_TOKEN}" \
+                -F "attachment=@${asset}"
+              echo
+            else
+              echo "Skipping ${asset} (not found)"
+            fi
+          done
+
       # Always run, regardless of job status. The script is a side-effect;
       # if the notification itself fails we swallow the error so CI does
       # not turn red on a Bark outage.
@@ -44,4 +93,4 @@ jobs:
             TITLE="❌ CI: ${{ github.repository }}@${{ github.ref_name }}"
             BODY="Build FAILED for ${{ github.sha }} by ${{ github.actor }}"
           fi
-          ./scripts/bark-notify.sh "$TITLE" "$BODY" || echo "Bark notify failed (non-fatal)"
+          ./.github/scripts/bark-notify.sh "$TITLE" "$BODY" || echo "Bark notify failed (non-fatal)"