Incremental package builds and releases on v* tags (0.8.0)

- build-packages.sh rebuilds a package only when its srcpkgs/ directory
  changed, its binary package is missing, or a dry-run install finds a
  shared library Void no longer provides; DASOS_REBUILD=1 rebuilds all.
  An unchanged `make packages` takes 20 s instead of 17 min on the CI host
- ci/release.sh publishes both ISOs and SHA256SUMS as a Gitea release
  when the workflow runs for a v* tag matching VERSION
- README and TODO updated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -1,5 +1,6 @@
 # Builds the Das OS packages and both ISO images on the CI host (see ci/runner).
 # Build output stays on the host in DASOS_OUT, set in the runner's config.
+# A v* tag also publishes the images as a release (ci/release.sh).
 name: build
 
 on:
@@ -15,6 +16,8 @@ concurrency:
 jobs:
   build:
     runs-on: dasci
+    permissions:
+      contents: write   # ci/release.sh creates releases
     steps:
       - uses: builtin:checkout
 
@@ -25,3 +28,12 @@ jobs:
 
       - name: Result
         run: ls -lh "$DASOS_OUT/iso/"*-"$(cat VERSION)"-x86_64.iso
+
+      # A v* tag publishes both images and their checksums as a release
+      - name: Release
+        if: startsWith(gitea.ref, 'refs/tags/v')
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_REPOSITORY: ${{ gitea.repository }}
+        run: ci/release.sh "${{ gitea.ref_name }}" "$DASOS_OUT/iso"