fix: do not let the changelog lookup kill the publish step

`git tag --sort=-v:refname | grep -A1 -x -F "$TAG"` matches nothing when
$TAG is not an existing tag, which is the normal case for a
workflow_dispatch run: the release is published for a tag nobody has
pushed and Gitea creates it. grep then exits 1, and under
`set -e -o pipefail` that took the step down before the first echo, so
the log showed exit code 1 and no output at all.

$TAG is now injected into the list before sorting, so the match is
guaranteed and the line before it is the real predecessor. `sort -uV`
also orders v2.9 before v2.10, which -v:refname over a list missing $TAG
could not.

Also asserts the token is non-empty up front rather than failing on an
opaque 401 several curls later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -164,7 +164,17 @@ jobs:
           api="$SERVER_URL/api/v1/repos/$REPO_PATH/releases"
           auth=(-H "Authorization: token $GITEA_TOKEN")
 
-          prev_tag=$(git tag --sort=-v:refname | grep -A1 -x -F "$TAG" | tail -n1)
+          # Fail here rather than on an opaque 401 four curls later.
+          [ -n "${GITEA_TOKEN:-}" ] || { echo "the BUILD_TOKEN secret is empty" >&2; exit 1; }
+
+          # The tag before $TAG, for the compare link. $TAG is injected into the list
+          # before sorting because it need not be a tag that exists: a
+          # workflow_dispatch run publishes a release for a tag nobody has pushed,
+          # and Gitea creates it. Without the injection grep matches nothing, and
+          # under `set -e -o pipefail` that took the whole step down before the first
+          # echo. `sort -uV` also puts v2.9 before v2.10, which -v:refname alone on a
+          # list missing $TAG cannot help with.
+          prev_tag=$( { git tag; echo "$TAG"; } | sort -uV | grep -B1 -x -F "$TAG" | head -n1 )
           if [ "$prev_tag" = "$TAG" ]; then prev_tag=""; fi
           if [ -n "$prev_tag" ]; then
             body="**Full Changelog**: $SERVER_URL/$REPO_PATH/compare/$prev_tag...$TAG"