release: harden upload pipeline (TAG/VER split, --fail-with-body, GITHUB_TOKEN, contents:write)

Aligns with the chip-plugin repos:
- Use TAG (with v prefix) for gh release create, VER (stripped) for
  Changelist lookup and upload.php's version field.
- curl --fail-with-body so server-side errors fail the workflow instead of
  passing silently.
- Switch GH_TOKEN to the auto-provided GITHUB_TOKEN with explicit
  contents:write permission, dropping the dependency on a per-repo
  ACCESS_TOKEN PAT.

release.sh

@@ -4,7 +4,10 @@ set -x
 cd "$(dirname "$0")"
 ROOT=$(pwd)
 
-VER="$GITHUB_REF_NAME"
+TAG="$GITHUB_REF_NAME"
+# Tags are pushed with a leading "v" (see tag.sh); strip for the changelog
+# lookup and the upload.php version field, but use TAG for gh release create.
+VER="${TAG#v}"
 
 # Extract the changelog section for the current version
 # Matches version with optional colon, captures until the next version line or EOF
@@ -32,13 +35,13 @@ if [ -f "./Binaries macOS/Symbols_Mac.zip" ]; then
   ASSETS+=("./Binaries macOS/Symbols_Mac.zip")
 fi
 
-gh release create "$VER" --title "$VER" -F /tmp/release_notes.txt "${ASSETS[@]}"
+gh release create "$TAG" --title "$TAG" -F /tmp/release_notes.txt "${ASSETS[@]}"
 
 PLUGIN=wavetable
 for f in "./Binaries Linux"/*.deb \
          "./Binaries Windows"/*.exe \
          "./Binaries macOS"/*.pkg; do
-  curl -sS -F "files=@${f}" \
+  curl -sS --fail-with-body -F "files=@${f}" \
           -F "plugin=${PLUGIN}" \
           -F "version=${VER}" \
           -F "changelog=${NOTES}" \