fix(release): fetch file SHAs from base branch, not next-release

After POST /branches reports 201 and GET /branches/next-release reports
200, the /contents/{path}?ref=next-release endpoint can still 500 or
404 transiently while Gitea finishes indexing the new branch. That
caused fetch_sha to return empty for files that actually existed on
base, so write_file fell back to POST (create) and got HTTP 422
"repository file already exists" five times before giving up.

Query base branch for the blob SHA instead. Base is stable, and Gitea
content writes are content-addressed by blob SHA, so a SHA fetched from
main works for PUT on next-release (next-release was just forked from
main, so the blob is identical). Treat 404 as "file absent" and retry
other non-200 responses up to 5 times.

.gitea/workflows/Release.yml

@@ -175,14 +175,29 @@ jobs:
             sleep 2
           done
 
-          # Fetch file blob SHAs from next-release (inherited from base on creation)
+          # Fetch file blob SHA from BASE_BRANCH. next-release was just forked
+          # from base so the blob SHA matches; querying base avoids racing
+          # Gitea's per-endpoint propagation for the new branch (the /contents
+          # endpoint can still 500/404 after /branches reports 200). Returns
+          # empty only when the file genuinely does not exist on base.
           fetch_sha() {
             local path="$1" out meta code body
-            out=$(api_call GET "/contents/${path}?ref=next-release")
-            meta=$(meta_line "${out}"); code="${meta%%|*}"; body=$(body_lines "${out}")
-            if [ "${code}" = "200" ]; then
-              printf '%s' "${body}" | jq -r '.sha // empty'
-            fi
+            for i in $(seq 1 5); do
+              out=$(api_call GET "/contents/${path}?ref=${BASE_BRANCH}")
+              meta=$(meta_line "${out}"); code="${meta%%|*}"; body=$(body_lines "${out}")
+              if [ "${code}" = "200" ]; then
+                printf '%s' "${body}" | jq -r '.sha // empty'
+                return 0
+              fi
+              if [ "${code}" = "404" ]; then
+                return 0
+              fi
+              if [ "${i}" = "5" ]; then
+                echo "fetch_sha ${path} failed after 5 attempts (${meta}): ${body}" >&2
+                return 0
+              fi
+              sleep 2
+            done
           }
           CHANGELOG_SHA=$(fetch_sha "CHANGELOG.md")
           VERSION_SHA=$(fetch_sha ".version")