GRM-35: fix: enforce tests pass before tagging a release

The release script now runs lint and tests before committing or tagging. If either fails, the release is aborted. Also fixes test_cli_version to use __version__ dynamically.

Closes GRM-35

.gitea/workflows/release.yml

@@ -12,6 +12,8 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.REPO_TOKEN }}
+      - name: Set up environment
+        run: make setup
       - name: Install git-cliff
         run: |
           GIT_CLIFF_VERSION="2.13.0"
@@ -23,8 +25,6 @@ jobs:
           chmod +x "$HOME/.local/bin/git-cliff"
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
           "$HOME/.local/bin/git-cliff" --version
-      - name: Install Python dependencies
-        run: python3 -m pip install --break-system-packages requests python-dotenv click
       - name: Configure git
         run: |
           git config user.name "grm-ci-bot"
@@ -33,6 +33,7 @@ jobs:
         env:
           PYTHONPATH: src
         run: |
+          . .venv/bin/activate
           python3 scripts/release.py
       - name: Notify on failure
         if: failure()
@@ -40,6 +41,7 @@ jobs:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           PYTHONPATH: src
         run: |
+          . .venv/bin/activate
           python3 scripts/notify_failure.py \
             --repo "${{ github.repository }}" \
             --run-id "${{ github.run_id }}" \