fix: read the changelog from the annotated tag, not the commit

actions/checkout leaves refs/tags/<tag> as a lightweight ref pointing straight
at the commit, so `git tag -l --format='%(contents)'` fell through to the commit
message. v1.0.4.0 shipped with the entire commit message as its changelog.

Re-fetch the tag ref so the annotated object is present, and only read a message
when the ref really is a tag object. Use subject+body instead of %(contents) so
a signature would not end up in the changelog, and fall back to build.yaml when
the tag is lightweight or its message is empty.

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -33,10 +33,29 @@ jobs:
           set -euo pipefail
           echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
-          # Annotated tag message becomes the changelog; build.yaml is the fallback.
+          # checkout leaves behind a lightweight ref pointing at the commit, and
+          # %(contents) on one of those yields the commit message. Re-fetch the
+          # real object so an annotated tag's message is what we read.
+          git fetch --force origin \
+            "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}" || true
+
+          CHANGELOG=""
+          if [ "$(git cat-file -t "refs/tags/${GITHUB_REF_NAME}" 2>/dev/null || true)" = "tag" ]; then
+            # subject+body rather than %(contents) so a signature is left out.
+            CHANGELOG="$(git for-each-ref \
+              --format='%(contents:subject)%0a%0a%(contents:body)' \
+              "refs/tags/${GITHUB_REF_NAME}")"
+          fi
+
+          # Lightweight tag, or an annotated tag with an empty message.
+          if [ -z "$(printf '%s' "$CHANGELOG" | tr -d '[:space:]')" ]; then
+            echo "no annotated tag message; falling back to build.yaml"
+            CHANGELOG="$(python -c "import yaml; print(yaml.safe_load(open('build.yaml')).get('changelog','').strip())")"
+          fi
+
           {
             echo "changelog<<CHANGELOG_EOF"
-            git tag -l --format='%(contents)' "$GITHUB_REF_NAME"
+            printf '%s\n' "$CHANGELOG"
             echo "CHANGELOG_EOF"
           } >> "$GITHUB_OUTPUT"