CI: build release body with printf (heredoc broke the YAML block scalar)

Co-Authored-By: Claude Fable 5 <[email protected]>

.gitea/workflows/sync-upstream.yml

@@ -214,35 +214,34 @@ jobs:
               *) TOKEN_NOTE="> **Launch-token auth (dsh 0.1.2+):** the Web UI requires a one-time token printed in \`docker logs\`; it rotates on every restart and is exchanged for a ~30-day cookie bound to the origin you open it on. \`@goodandready/dsh-lanmode\` ≤0.6.8 is incompatible with this line.";;
             esac
 
-            BODY=$(cat <<EOF
-${KIND}
-
-\`\`\`
-docker pull gitea.milesward.dev/mward4/deepseek-harness:${TAG}
-\`\`\`
-
-### What's inside
-
-| | |
-|---|---|
-| dsh | \`${VER}\` — [upstream release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v${VER}) |
-| pnpm | \`${PNPMV:-unknown}\` |
-| base image | \`${BASEV:-unknown}\` |
-| image digest | \`${DIGEST}\` |
-| built from | \`main@${MAIN_SHA}\` (published by CI run #${RUN_NUMBER}) |
-
-### Deploy on Unraid
-
-- **Repository:** \`gitea.milesward.dev/mward4/deepseek-harness:${TAG}\`
-- **Post Arguments** (replace the image command entirely):
-  \`web --patch /opt/deepseek-harness/web.cordis.patch.yml --no-open --trusted-host <host> [--trusted-host <host2>]\`
-- First run: \`chown -R 1000:1000 /mnt/user/appdata/deepseek-harness\`
-
-${TOKEN_NOTE}
-
-Image tags are immutable — this release will never be rebuilt or moved. See the [README](https://gitea.milesward.dev/mward4/deepseek-harness#versions-and-upgrades) for the upgrade procedure.
-EOF
-)
+            # Body assembled line-by-line (a heredoc's column-0 lines would
+            # terminate this YAML block scalar).
+            BODY=$(printf '%s\n' \
+              "${KIND}" \
+              "" \
+              '```' \
+              "docker pull gitea.milesward.dev/mward4/deepseek-harness:${TAG}" \
+              '```' \
+              "" \
+              "### What's inside" \
+              "" \
+              "| | |" \
+              "|---|---|" \
+              "| dsh | \`${VER}\` — [upstream release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v${VER}) |" \
+              "| pnpm | \`${PNPMV:-unknown}\` |" \
+              "| base image | \`${BASEV:-unknown}\` |" \
+              "| image digest | \`${DIGEST}\` |" \
+              "| built from | \`main@${MAIN_SHA}\` (published by CI run #${RUN_NUMBER}) |" \
+              "" \
+              "### Deploy on Unraid" \
+              "" \
+              "- **Repository:** \`gitea.milesward.dev/mward4/deepseek-harness:${TAG}\`" \
+              "- **Post Arguments** (replace the image command entirely): \`web --patch /opt/deepseek-harness/web.cordis.patch.yml --no-open --trusted-host <host> [--trusted-host <host2>]\`" \
+              "- First run: \`chown -R 1000:1000 /mnt/user/appdata/deepseek-harness\`" \
+              "" \
+              "${TOKEN_NOTE}" \
+              "" \
+              "Image tags are immutable — this release will never be rebuilt or moved. See the [README](https://gitea.milesward.dev/mward4/deepseek-harness#versions-and-upgrades) for the upgrade procedure.")
             BODY_JSON=$(printf '%s' "$BODY" | json_escape)
 
             # Tag main at the commit that built the image (ignore "already exists").