ci(release): push tag to Codeberg before creating the release

The first fix didn't help: the pipeline creates the tag via the Gitea
API, and the push mirror (sync_on_commit only fires on real git pushes)
doesn't propagate an API-created tag promptly. So the Codeberg release
POST still raced the mirror and 500'd on a commit/tag Codeberg hadn't
received (0.2.1 and 0.3.0 both shipped everywhere but Codeberg).

Push the tag straight to Codeberg from the runner (guaranteed present),
then attach the release to that existing tag with no target_commitish —
which is what Forgejo 500s on. Race-free.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -399,27 +399,27 @@ jobs:
             sed -i -e '/./,$!d' release-notes.md
           fi
           [ -s release-notes.md ] || echo "_See CHANGELOG.md for ${VERSION}._" > release-notes.md
-          # The push mirror (sync_on_commit) usually syncs the tag to Codeberg
-          # before this step runs. Forgejo 500s on POST /releases with a
-          # target_commitish when the tag already exists — so only pass
-          # target_commitish when we actually need the API to create the tag.
-          TAG_CODE=$(curl -s -o /dev/null -w '%{http_code}' \
-            -H "Authorization: token $TOKEN" "$API/git/refs/tags/$TAG")
-          python3 - "$TAG" "$SHA" "$PRERELEASE" "$TAG_CODE" <<'PY' > cb-payload.json
+          # The pipeline creates the tag via the Gitea API, which the push mirror
+          # (sync_on_commit only fires on real git pushes) doesn't propagate
+          # promptly — so a release POST that carries a target_commitish can
+          # outrun the mirror and 500 on a commit/tag Codeberg hasn't received.
+          # Push the tag straight to Codeberg so it's guaranteed present, then
+          # attach the release to that existing tag with NO target_commitish
+          # (which is what triggered the 500).
+          git tag -f "$TAG" "$SHA"
+          git push -f "https://jlmakiola:${TOKEN}@codeberg.org/jlmakiola/agendula.git" \
+            "refs/tags/$TAG"
+          python3 - "$TAG" "$PRERELEASE" <<'PY' > cb-payload.json
           import json, sys
-          tag, sha, pre, tag_code = sys.argv[1:5]
-          payload = {
+          tag, pre = sys.argv[1:3]
+          print(json.dumps({
               "tag_name": tag,
               "name": tag,
               "body": open("release-notes.md").read(),
               "draft": False,
               # Pre-1.0 releases are flagged as pre-releases (see detect job).
               "prerelease": pre == "true",
-          }
-          # Only create the tag via the release when it isn't mirrored yet.
-          if tag_code != "200":
-              payload["target_commitish"] = sha
-          print(json.dumps(payload))
+          }))
           PY
           # Upsert (re-run safe).
           ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')