feat(release): semantic-release versioning + self-update v-prefix fix (spec 25)

[gustavobertoi]

Ships the release-automation thin slice (spec 25 / FEATURES #17 — the v0.2.0 gate) and lands the four new feature specs 22–25 designed in this session.

How releases work (single workflow, no token)

One release.yml does everything with the built-in GITHUB_TOKEN — no PAT/App token to manage:

• push to main → svu next --v0 → 0.x guard → (gated on the RELEASE_ENABLED repo variable) git tag + goreleaser release in the same job.
• push a v* tag by hand → skips svu, runs goreleaser directly (manual release, ungated).
• workflow_dispatch → manual trigger of the automated path.

Why one job: contents: write lets a workflow push a tag, but a tag pushed with GITHUB_TOKEN does not re-trigger another workflow (GitHub's recursion guard). Folding compute + release into one job is what removes the need for a separate token. The old two-workflow tag.yml + RELEASE_TOKEN approach was dropped.

Kill-switch: the RELEASE_ENABLED repo variable (default off = compute + log, never release). No secret to rotate.

Pieces

• .svu.yaml v0:true — BETA stays 0.x (BREAKING → minor, never 1.0.0).
• .github/workflows/release.yml — rewritten single-job pipeline (above), svu pinned v3.4.1, CI v0.* guard.
• .github/workflows/pr-title.yml — pure-shell conventional-commit PR-title lint.
• .goreleaser.yaml — grouped changelog (Features / Bug fixes / Performance) + the ldflags v-prefix fix.
• Specs 22–25 (docs) — init wizard · template/Dockerfile authoring · .env ingestion · release automation; all TUIs are Bubble Tea v2 + Charm (bubbles/lipgloss/huh v2). Wired into FEATURES (feat(secrets): S1 — secret:// core (parser, Provider iface, registry, batched Resolve) #14–17) + a ROADMAP M8 beta-DX lane (stays 0.x).

The load-bearing fix

goreleaser's {{.Version}} is the tag with the v stripped (0.2.0). x/mod/semver requires the leading v, so internal/selfupdate.IsDevBuild() (returns !semver.IsValid(v)) treats a real release as a dev build → the v0.1.0 update notifier + self update are silently dead. Fix: stamp Version=v{{ .Version }} (archive name_template stays v-stripped, matching assetName's TrimPrefix).

Verified against the real code:

Version="0.2.0"              IsValid=false  IsDevBuild=true   # old stamp -> no self-update
Version="v0.2.0"             IsValid=true   IsDevBuild=false  # the fix
Version="v0.1.1-dev-abc1234" IsValid=true   IsDevBuild=false  # snapshot, valid

goreleaser check passes; a snapshot build now stamps v0.1.1-dev-<sha>.

⚠️ Owner action to cut v0.2.0 (not done here)

Set the kill-switch on, then trigger:

gh variable set RELEASE_ENABLED --body true
# then merge a feat: PR / run the Release workflow, or: git tag v0.2.0 && git push origin v0.2.0

svu next --v0 computes v0.2.0 from the M2–M7 history. Only ever push v* semver tags.

Specs 22–24 are design-only; their implementation is the M8 lane (build order: this PR first, then init → template → env-ingest).

🤖 Generated with Claude Code