fix(release): repair pipeline defects found in v0.1.0-rc.1 rehearsal

Four defects from the rc.1 dress rehearsal:

- Dockerfile pinned golang:1.26-alpine3.23 at a 1.26.3 digest while
  go.mod requires 1.26.4; golang images set GOTOOLCHAIN=local, so the
  build hard-fails. Pin 1.26.4-alpine3.23 explicitly.
- changelog.disable swallowed --release-notes (the flag is consumed by
  the changelog pipe), publishing empty release bodies. Re-enable.
- Remove the Gitea-side GitHub relay step: redundant with
  .github/workflows/mirror-release.yml, which runs on GitHub Actions
  with the built-in token and copies the canonical Gitea assets.
- mirror-release.yml: jq '.body // empty' treats "" as truthy so the
  notes fallback never fired; use select(). Mark rc tags --prerelease.

.gitea/workflows/release-binaries.yml

@@ -53,37 +53,6 @@ jobs:
           GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           GITEA_API_URL: http://gitea:3000/api/v1
 
-      # GoReleaser publishes to exactly one SCM (Gitea). The push mirror
-      # carries git refs but not release artifacts, so relay the release to
-      # the GitHub mirror — README install links point there.
-      - name: Mirror release to GitHub
-        env:
-          GH_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }}
-        run: |
-          if [ -z "$GH_TOKEN" ]; then
-            echo "GH_MIRROR_TOKEN not set — skipping GitHub release relay"
-            exit 0
-          fi
-          apk add --no-cache github-cli
-          TAG="${{ github.ref_name }}"
-
-          # Nudge the push mirror, then wait for the tag to land on GitHub.
-          curl -sf -X POST \
-            -H "Authorization: token ${{ secrets.RELEASE_TOKEN }}" \
-            "http://gitea:3000/api/v1/repos/lerkolabs/uptop/push_mirrors-sync" || true
-          for i in $(seq 1 30); do
-            if gh api "repos/lerkolabs/uptop/git/ref/tags/${TAG}" >/dev/null 2>&1; then
-              break
-            fi
-            sleep 10
-          done
-
-          PRERELEASE=""
-          case "$TAG" in *-*) PRERELEASE="--prerelease";; esac
-          gh release create "$TAG" \
-            --repo lerkolabs/uptop \
-            --verify-tag \
-            --title "$TAG" \
-            --notes-file /tmp/release-notes.md \
-            $PRERELEASE \
-            dist/*.tar.gz dist/*.zip dist/*.deb dist/*.rpm dist/checksums.txt
+      # GitHub release relaying is handled by .github/workflows/mirror-release.yml,
+      # which runs on GitHub Actions when the push mirror delivers the tag and
+      # copies this run's Gitea release assets — no PAT needed on this side.