Document the automation, and fix the stale defaults in the manual script

The README now covers both workflows: what the REGISTRY_TOKEN secret is for,
why the release only fires on a tag, and the three commands to cut a release.

`build-and-publish-unraid.sh` still defaulted to IMAGE_TAG=0.1.0 and
GIT_REF=v0.1, which would have built a two-release-old tag by hand and pushed
it as the current one. Both now point at 0.1.3.

README.md

@@ -178,10 +178,49 @@ rewrote all the secrets.
 
 ### Building and publishing the image
 
+Pushing a version tag builds, smoke-tests, pushes and releases — see
+[Automation](#automation) below. To do it by hand instead:
+
 ```bash
 GITEA_TOKEN=<token with write:package> ./scripts/build-and-publish-unraid.sh
 ```
 
+### Automation
+
+Two workflows under `.gitea/workflows/`, both needing a repository secret named
+`REGISTRY_TOKEN` with the `write:package` scope (Settings → Actions → Secrets).
+Gitea reserves the `GITEA_` prefix for secret names and rejects it, which is why
+the secret is not called `GITEA_TOKEN`.
+
+**`release.yml`** runs when a `vX.Y.Z` tag is pushed. It builds the image,
+starts it on a fresh root-owned volume, waits for `/healthz`, checks the binary
+reports the tagged version, pushes to the registry, and only then creates the
+release. The order matters: a release announcing an image that isn't in the
+registry yet is worse than no release, and a broken build must not overwrite a
+tag that already works. The workflow also asserts the tag and `Cargo.toml`
+agree, which is what catches a tag pushed without a version bump.
+
+Release notes come from `docs/releases/<version>.md` when that file exists.
+
+```bash
+# cut a release
+sed -i 's/^version = "0.1.3"/version = "0.1.4"/' Cargo.toml   # and Cargo.lock
+git commit -am "v0.1.4: ..."
+git tag -a v0.1.4 -m "v0.1.4: ..."
+git push origin main v0.1.4
+```
+
+**`dependency-check.yml`** runs every six hours and reports drifted crates, the
+Rust pin and the Docker base images in a single issue titled "Dependency
+updates" — rewritten in place rather than commented on, and closed
+automatically when nothing is out of date. `.gitea/scripts/dependency-report.mjs`
+does the work and is shared verbatim with the sibling Rust repos.
+
+Nothing is upgraded automatically: the report separates what `cargo update`
+covers from what crosses a breaking boundary, and leaves the decision to a
+human. A service holding someone's second factor is the wrong place for
+unreviewed dependency bumps.
+
 ---
 
 ## Using it

scripts/build-and-publish-unraid.sh

@@ -13,9 +13,9 @@
 #   GITEA_OWNER   default: mward4
 #   GITEA_REPO    default: Discord-Authenticator
 #   IMAGE_NAME    default: discord-authenticator
-#   IMAGE_TAG     default: 0.1.0   (also pushed as :latest)
+#   IMAGE_TAG     default: 0.1.3   (also pushed as :latest)
 #   PLATFORM      default: linux/amd64  (Unraid is x86_64)
-#   GIT_REF       default: v0.1    (tag/branch to build)
+#   GIT_REF       default: v0.1.3  (tag/branch to build)
 #   WORKDIR       default: /tmp/discord-authenticator-build (removed on exit)
 #
 # After this, set the Unraid template's Repository to:
@@ -27,9 +27,9 @@ GITEA_HOST=${GITEA_HOST:-gitea.milesward.dev}
 GITEA_OWNER=${GITEA_OWNER:-mward4}
 GITEA_REPO=${GITEA_REPO:-Discord-Authenticator}
 IMAGE_NAME=${IMAGE_NAME:-discord-authenticator}
-IMAGE_TAG=${IMAGE_TAG:-0.1.0}
+IMAGE_TAG=${IMAGE_TAG:-0.1.3}
 PLATFORM=${PLATFORM:-linux/amd64}
-GIT_REF=${GIT_REF:-v0.1}
+GIT_REF=${GIT_REF:-v0.1.3}
 WORKDIR=${WORKDIR:-/tmp/discord-authenticator-build}
 
 # OCI distribution rejects uppercase repository paths, so the image name is