Before committing, release.sh now checks whether git can sign by running
a throwaway signed commit-tree. If that fails, because there is no
user.signingkey or no agent holds the key, the script warns and makes
the release commit with --no-gpg-sign. The success message now says
whether the commit is signed or unsigned. AGENTS.md is updated to match.
- a local tag that differs from origin, such as a tag moved on origin before the tag protection rule, failed the fetch with "could not fetch origin" and no reason, as --quiet also hid the rejected tags
- An upstream line is tagged v<upstream>-v<version> in git instead of <upstream>-v<version>
- Coolify has no upstream lines, its git tags stay v<version>, and the v is stripped from the Docker image tags
- Asks for the stage of a prerelease and offers the versions the branch allows, the bump the commits need is preselected
- Sets the version in release.json, dates CHANGELOG.md for a stable release, commits and pushes
- undo-release.sh resets the release commit while it is not pushed