release: harden upload pipeline (TAG/VER split, --fail-with-body, GITHUB_TOKEN, contents:write)

Aligns with the chip-plugin repos:
- Use TAG (with v prefix) for gh release create, VER (stripped) for
  Changelist lookup and upload.php's version field.
- curl --fail-with-body so server-side errors fail the workflow instead of
  passing silently.
- Switch GH_TOKEN to the auto-provided GITHUB_TOKEN with explicit
  contents:write permission, dropping the dependency on a per-repo
  ACCESS_TOKEN PAT.

.github/workflows/release.yaml

@@ -67,6 +67,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - name: Download Artifacts
@@ -75,5 +77,5 @@ jobs:
         run: ./release.sh
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.ACCESS_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APIKEY:   ${{ secrets.APIKEY }}

release.sh

@@ -4,7 +4,10 @@ set -x
 cd "$(dirname "$0")"
 ROOT=$(pwd)
 
-VER="$GITHUB_REF_NAME"
+TAG="$GITHUB_REF_NAME"
+# Tags are pushed with a leading "v" (see tag.sh); strip for the changelog
+# lookup and the upload.php version field, but use TAG for gh release create.
+VER="${TAG#v}"
 
 # Extract the changelog section for the current version
 # Matches version with optional colon, captures until the next version line or EOF
@@ -32,13 +35,13 @@ if [ -f "./Binaries macOS/Symbols_Mac.zip" ]; then
   ASSETS+=("./Binaries macOS/Symbols_Mac.zip")
 fi
 
-gh release create "$VER" --title "$VER" -F /tmp/release_notes.txt "${ASSETS[@]}"
+gh release create "$TAG" --title "$TAG" -F /tmp/release_notes.txt "${ASSETS[@]}"
 
 PLUGIN=wavetable
 for f in "./Binaries Linux"/*.deb \
          "./Binaries Windows"/*.exe \
          "./Binaries macOS"/*.pkg; do
-  curl -sS -F "files=@${f}" \
+  curl -sS --fail-with-body -F "files=@${f}" \
           -F "plugin=${PLUGIN}" \
           -F "version=${VER}" \
           -F "changelog=${NOTES}" \

tag.sh

@@ -13,5 +13,5 @@ if ! grep -q "^${VER}:*$" Changelist.txt; then
     exit 1
 fi
 
-echo "Tagging [$VER]"
-git tag "$VER" && git push origin "$VER"
+echo "Tagging [v$VER]"
+git tag "v$VER" && git push origin "v$VER"