feat: publish releases with this repository's own SDK code

There is no CI: the instance has no act_runner and none is planned, so releases
are cut by hand. That makes `make check` the only thing standing between a
mistake and the tracker, and it is one command: gofmt, vet, the suite with the
cache defeated, `go mod verify`, a vendored build, and `kettle gen skills
--check`. The last one is the invariant worth having — the plugin's SKILL.md
command reference is generated from the binary's registry, so a flag that
changed cannot ship with documentation that recommends the old one.

`cli/cmd/release` publishes to Gitea using the same SDK the binary already
vendors, which is a pleasing thing to be able to say: nothing third-party
handles the artifacts. It is a second binary rather than a `kettle` subcommand
on purpose — `kettle`'s command tree is what generates the plugin's skills, so a
verb there ships to every operator, and publishing a release is build
infrastructure. It is idempotent end to end: an existing release for the tag is
reused, an asset of the same name is replaced rather than doubled, and a retried
run converges instead of duplicating.

`make release` refuses three things, each with its own message: a dirty working
tree, a TAG that is not what `git describe` reports, and a tag the remote does
not have. A release built from uncommitted code is unreproducible and nobody
finds out until they need to reproduce it.

`kettle version` reports the stamp, the toolchain and the VCS revision. The
default is `dev`, and a hand build says so and means it — a binary out of
somebody's working tree is not a release and must not claim to be one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/kettle/AGENTS.md

@@ -31,8 +31,9 @@ go install git.noodles.cam/claude-skills/marketplace/cli/cmd/kettle@latest
 ```
 
 `cli/go.mod` says **go 1.26** — the Gitea SDK requires it, so that is the minimum
-for anybody building this. `vendor/` is committed, so a build from a clone needs
-no network.
+for anybody building this. There is no `vendor/`: a build resolves its modules from
+the module cache or the network, and `go.sum` is what makes that safe. Why that
+trade was taken is in [`cli/AGENTS.md`](../../cli/AGENTS.md).
 
 An operator who sees `command not found: kettle` installs it and re-runs; there
 is nothing to configure in this plugin either way. `kettle config` is the command
@@ -89,7 +90,7 @@ agents/
   kettle-runner.md           subagent (Haiku): runs kettle commands, reports a
                              receipt. Batches only, and no opinions about content
 hooks/
-  hooks.json                 registers the PreToolUse hooks
+  hooks.json                 registers the one hook: PreToolUse(Bash)
   agents-sync.sh             keeps every directory canonical: AGENTS.md a real
                              file, CLAUDE.md a symlink to it
 skills/
@@ -138,7 +139,12 @@ and it stays hand-written.
 | `.claude/settings.local.json` → `env.GITEA_LOGIN`, the login pin | `<project>/.kettle/config.yaml` (a login **name**) plus `~/.config/kettle/logins.yaml` (the tokens, 0600, outside every working tree) |
 | the tea plugin's own store marker | `.kettle/`; `kettle init` migrates an older layout in, and each migration is a move |
 
-`hooks/agents-sync.sh` is unrelated to any of that and stays.
+`hooks/agents-sync.sh` is unrelated to any of that and stays. It maintains the
+`AGENTS.md` convention by repairing the filesystem layout — a real file, with
+`CLAUDE.md` a symlink to it — and the convention itself is documented once,
+in [the repository root's AGENTS.md](../../AGENTS.md#the-agentsmd-convention). It
+cannot fail a tool call: it exits 0 on every path, including its own bugs —
+documentation maintenance is not permitted to break a build.
 
 All of it is in git history. `git log --diff-filter=D` finds it if a decision
 needs to be re-read rather than re-derived.
@@ -154,3 +160,17 @@ cd cli && go test ./...
 
 The second line is the plugin's only mechanical invariant: the documentation an
 agent reads agrees with the binary it is documenting.
+
+## Keeping this file true
+
+- **Scope:** everything under `plugins/kettle/` — the skills, the runner subagent,
+  the two hooks, and the group ⇄ skill seam. `skills/` and `agents/` carry no
+  AGENTS.md of their own on purpose: a SKILL.md already states its own procedure,
+  and a second document beside it would be the copy that goes stale.
+- **Update it when** a skill is added or removed (the layout and the generated-region
+  table both name every one), a hook is added or its event changes, a rule in *the
+  rules that must survive* changes, or the binary takes over something this plugin
+  used to state.
+- **Do not** restate the binary's design. [`cli/AGENTS.md`](../../cli/AGENTS.md) and
+  the eight package files under it own that; if the two ever disagree, the binary is
+  right and the prose is stale.