ci(release): create the Codeberg release while the tag is absent

Revert 4aa65ed's approach. It read the Forgejo 500 as being caused by
target_commitish, and pushed the tag to Codeberg first so the release could
attach to an existing tag without one. That inverted the actual failure:
Forgejo 500s on POST /releases precisely WHEN the tag already exists, so
pre-pushing it guarantees the error it was meant to avoid.

The second half then can't recover — a bare tag is not a release, so
GET /releases/tags 404s and the upsert has no id, which is the
"Could not resolve Codeberg release id" that ended the 0.3.1 run.

0.3.0 published fine because it POSTed while the tag was still unsynced and
let the API mint tag + release together. Do that deliberately instead of by
luck: if no release owns the tag, delete the mirrored tag, then POST with
target_commitish. Branches mirror reliably (main was already at the release
commit when 0.3.1 failed), so the commit is present and only the raced-in
tag was in the way. Deleting it is safe exactly because no release owns it.

An existing release still takes the PATCH path and skips the delete, so
re-runs never disturb something already published.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yaml

@@ -399,30 +399,39 @@ jobs:
             sed -i -e '/./,$!d' release-notes.md
           fi
           [ -s release-notes.md ] || echo "_See CHANGELOG.md for ${VERSION}._" > release-notes.md
-          # The push mirror (sync_on_commit) usually syncs the tag to Codeberg
-          # before this step runs. Forgejo 500s on POST /releases with a
-          # target_commitish when the tag already exists — so only pass
-          # target_commitish when we actually need the API to create the tag.
-          TAG_CODE=$(curl -s -o /dev/null -w '%{http_code}' \
-            -H "Authorization: token $TOKEN" "$API/git/refs/tags/$TAG")
-          python3 - "$TAG" "$SHA" "$PRERELEASE" "$TAG_CODE" <<'PY' > cb-payload.json
+          # Forgejo 500s on POST /releases when the tag ALREADY exists, and a
+          # bare tag is not a release — so GET /releases/tags then 404s and the
+          # upsert has no id to fall back on ("Could not resolve Codeberg
+          # release id", the 0.3.1 failure). Pushing the tag first therefore
+          # guarantees the 500 rather than avoiding it; 0.3.0 published because
+          # it POSTed while the tag was still absent. So: POST with the tag
+          # ABSENT and let the API mint tag + release together from
+          # target_commitish. Branches mirror reliably, so the commit is already
+          # on Codeberg — only a tag the mirror raced in ahead of us is in the
+          # way, and clearing it is safe precisely because no release owns it.
+          ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
+          if [ -z "$ID" ]; then
+            curl -s -o /dev/null -w "codeberg tag DELETE HTTP %{http_code}\n" -X DELETE \
+              -H "Authorization: token $TOKEN" "$API/tags/$TAG"
+          fi
+          python3 - "$TAG" "$SHA" "$PRERELEASE" <<'PY' > cb-payload.json
           import json, sys
-          tag, sha, pre, tag_code = sys.argv[1:5]
-          payload = {
+          tag, sha, pre = sys.argv[1:4]
+          print(json.dumps({
               "tag_name": tag,
+              # Recreate the tag as part of the release; the commit is on
+              # Codeberg already via the branch mirror.
+              "target_commitish": sha,
               "name": tag,
               "body": open("release-notes.md").read(),
               "draft": False,
               # Pre-1.0 releases are flagged as pre-releases (see detect job).
               "prerelease": pre == "true",
-          }
-          # Only create the tag via the release when it isn't mirrored yet.
-          if tag_code != "200":
-              payload["target_commitish"] = sha
-          print(json.dumps(payload))
+          }))
           PY
-          # Upsert (re-run safe).
-          ID=$(curl -s -H "Authorization: token $TOKEN" "$API/releases/tags/$TAG" | jq -r '.id // empty')
+          # Upsert (re-run safe): a release that already exists is PATCHed in
+          # place — the delete above is skipped in that case, so re-running
+          # never disturbs a published release.
           if [ -n "$ID" ]; then
             curl -s -o /dev/null -w "release PATCH HTTP %{http_code}\n" -X PATCH \
               -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \