Aligns with the chip-plugin repos:
- Use TAG (with v prefix) for gh release create, VER (stripped) for
Changelist lookup and upload.php's version field.
- curl --fail-with-body so server-side errors fail the workflow instead of
passing silently.
- Switch GH_TOKEN to the auto-provided GITHUB_TOKEN with explicit
contents:write permission, dropping the dependency on a per-repo
ACCESS_TOKEN PAT.