release: harden upload pipeline (TAG/VER split, --fail-with-body, GITHUB_TOKEN, contents:write)

Aligns with the chip-plugin repos:
- Use TAG (with v prefix) for gh release create, VER (stripped) for
  Changelist lookup and upload.php's version field.
- curl --fail-with-body so server-side errors fail the workflow instead of
  passing silently.
- Switch GH_TOKEN to the auto-provided GITHUB_TOKEN with explicit
  contents:write permission, dropping the dependency on a per-repo
  ACCESS_TOKEN PAT.

.github/workflows/release.yaml

@@ -67,6 +67,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - name: Download Artifacts
@@ -75,5 +77,5 @@ jobs:
         run: ./release.sh
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.ACCESS_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APIKEY:   ${{ secrets.APIKEY }}