feat: publish releases with this repository's own SDK code

There is no CI: the instance has no act_runner and none is planned, so releases
are cut by hand. That makes `make check` the only thing standing between a
mistake and the tracker, and it is one command: gofmt, vet, the suite with the
cache defeated, `go mod verify`, a vendored build, and `kettle gen skills
--check`. The last one is the invariant worth having — the plugin's SKILL.md
command reference is generated from the binary's registry, so a flag that
changed cannot ship with documentation that recommends the old one.

`cli/cmd/release` publishes to Gitea using the same SDK the binary already
vendors, which is a pleasing thing to be able to say: nothing third-party
handles the artifacts. It is a second binary rather than a `kettle` subcommand
on purpose — `kettle`'s command tree is what generates the plugin's skills, so a
verb there ships to every operator, and publishing a release is build
infrastructure. It is idempotent end to end: an existing release for the tag is
reused, an asset of the same name is replaced rather than doubled, and a retried
run converges instead of duplicating.

`make release` refuses three things, each with its own message: a dirty working
tree, a TAG that is not what `git describe` reports, and a tag the remote does
not have. A release built from uncommitted code is unreproducible and nobody
finds out until they need to reproduce it.

`kettle version` reports the stamp, the toolchain and the VCS revision. The
default is `dev`, and a hand build says so and means it — a binary out of
somebody's working tree is not a release and must not claim to be one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

plugins/kettle/README.md

@@ -27,7 +27,7 @@ the tool.
 - **Claude Code** — CLI, desktop app, or IDE extension.
 - **The `kettle` binary, on your `PATH`.** It is not installed for you, and
   nothing here works without it — see below.
-- **Python 3** — the `agents-sync` hook is a Python script; `python3` must be on
+- **Python 3** — the two `agents-*` hooks are Python scripts; `python3` must be on
   `$PATH`. Nothing else here needs it.
 - **`tea`** (optional) — Gitea's own CLI, only for `/kettle:use`. `brew install
   tea`, or from [gitea.com/gitea/tea/releases](https://gitea.com/gitea/tea/releases).
@@ -36,7 +36,8 @@ the tool.
 ### Installing the binary
 
 Building it needs **Go 1.26** — `cli/go.mod` says so because the Gitea SDK
-requires it. `vendor/` is committed, so the build itself needs no network.
+requires it. There is no `vendor/` directory: the first build downloads eight
+modules, verified against `go.sum`.
 
 ```bash
 # from a clone of this repository
@@ -159,7 +160,7 @@ dependency come back as a question, not as a guess.
 agents/
   kettle-runner.md           subagent (Haiku) that runs the commands
 hooks/
-  hooks.json                 registers the PreToolUse hooks
+  hooks.json                 registers the one hook
   agents-sync.sh             keeps AGENTS.md real and CLAUDE.md a symlink to it
 skills/
   init/                      /kettle:init — make a directory a project