GRM-35: fix: enforce tests pass before tagging a release

The release script now runs lint and tests before committing or tagging. If either fails, the release is aborted. Also fixes test_cli_version to use __version__ dynamically.

Closes GRM-35

AGENTS.md

@@ -124,13 +124,17 @@ After a PR is merged to master, the release pipeline runs automatically:
 
 1. **Release workflow** (`.gitea/workflows/release.yml`):
    - Triggers on push to master
+   - Sets up full dev environment (`make setup`) so lint and tests can run
    - Runs `scripts/release.py` which uses **git-cliff** to:
      - Calculate the next semver version from conventional commits since the last tag
      - Update `__version__` in `src/gitea_runner_manager/__init__.py` (single source of truth)
      - Update `CHANGELOG.md` with the new version section
+     - **Run `make lint-ruff` and `make pytest-cov`** to verify the release is healthy
+     - If lint or tests fail, **abort immediately** — no commit, no tag
      - Commit with `release: vX.Y.Z` prefix (cleaner than `chore(release):`)
      - Create an annotated tag `vX.Y.Z` on the release commit
      - Push both the commit and tag to master
+   - `--skip-tests` flag bypasses test verification (emergency use only, not recommended)
    - Loops are prevented by `has_unreleased_changes` — after a release commit is tagged, the next run finds no unreleased changes and exits
    - On failure, creates a Gitea issue via `scripts/notify_failure.py`