Fix release pipeline: escape shell vars so cross-compiled assets build (#16)

## Why

The **v0.5.3** release pipeline failed at the asset-upload step with `open node-lookup-linux-amd64: no such file or directory`, and release notes came out empty. Woodpecker substitutes `${...}` expressions in `commands` **at parse time**, treating them as pipeline variables. The build loop's shell parameter expansions (`${name}`, `${osarch%/*}`, `${pkg}`) and the release step's `${PREV_TAG}`/`${NOTES}` were blanked before the shell ran, so the per-os/arch binaries were written to garbled names and never matched the upload list.

The RPM itself was unaffected (it's built via `make build`, internal to the Makefile) and `node-lookup-0.5.3-1.x86_64.rpm` published to `rpm-internal` correctly — only the Gitea release binary assets and notes were broken.

## Changes

- Escape all shell variables and command substitutions in the build loop and the release-notes block as `$$`, matching the existing `upload-rpm` step's convention. Genuine Woodpecker vars (`${CI_COMMIT_TAG}`, `${CI_REPO}`) stay single-`$`.

## Follow-up

The v0.5.3 Gitea release assets are being backfilled manually; this fix ensures v0.5.4+ produce them automatically.

Reviewed-on: #16
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

.woodpecker/release.yaml

@@ -24,13 +24,17 @@ steps:
     image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
     commands:
       - make build VERSION=${CI_COMMIT_TAG}
+      # Shell variables/expansions are escaped as $$ so Woodpecker leaves them
+      # for the shell instead of substituting them (as pipeline vars) at parse
+      # time. ${CI_COMMIT_TAG} is a real Woodpecker var and stays single-$.
       - |
         for entry in "node-lookup:." "pburl:./cmd/pburl" "pblastreport:./cmd/pblastreport"; do
-          name="${entry%%:*}"; pkg="${entry##*:}"
+          name="$${entry%%:*}"; pkg="$${entry##*:}"
           for osarch in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64; do
-            GOOS="${osarch%/*}" GOARCH="${osarch#*/}" \
+            os="$${osarch%/*}"; arch="$${osarch#*/}"
+            GOOS="$$os" GOARCH="$$arch" \
               go build -ldflags="-s -w -X main.version=${CI_COMMIT_TAG}" \
-              -o "${name}-${osarch%/*}-${osarch#*/}" "${pkg}"
+              -o "$${name}-$${os}-$${arch}" "$$pkg"
           done
         done
     depends_on: [test]
@@ -107,13 +111,15 @@ steps:
       - |
         curl --output /usr/local/bin/tea https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/gitea-dl/tea/0.12.0/tea-0.12.0-linux-amd64 && chmod +x /usr/local/bin/tea
         tea logins add --name gitea --url https://git.unkin.net --token "$${RELEASER_TOKEN}" --no-version-check
-        PREV_TAG=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
-        if [ -n "$PREV_TAG" ]; then
-          NOTES=$(git log "${PREV_TAG}..${CI_COMMIT_TAG}" --pretty=format:"- %s")
+        # $$ escapes shell vars/substitutions so Woodpecker doesn't blank them
+        # at parse time; ${CI_COMMIT_TAG}/${CI_REPO} are real Woodpecker vars.
+        PREV_TAG=$$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo "")
+        if [ -n "$$PREV_TAG" ]; then
+          NOTES=$$(git log "$${PREV_TAG}..${CI_COMMIT_TAG}" --pretty=format:"- %s")
         else
-          NOTES=$(git log --pretty=format:"- %s")
+          NOTES=$$(git log --pretty=format:"- %s")
         fi
-        tea releases create --tag "${CI_COMMIT_TAG}" --title "${CI_COMMIT_TAG}" --note "${NOTES}" --login gitea --repo "${CI_REPO}"
+        tea releases create --tag "${CI_COMMIT_TAG}" --title "${CI_COMMIT_TAG}" --note "$${NOTES}" --login gitea --repo "${CI_REPO}"
         tea releases assets create "${CI_COMMIT_TAG}" \
           node-lookup-linux-amd64 \
           node-lookup-linux-arm64 \