refactor(release): use pretty download_url from /releases/{id} API

Gitea's POST /releases/{id}/assets endpoint returns an internal
/attachments/<uuid> URL. GET /releases/{id} returns the pretty
/<owner>/<repo>/releases/download/<tag>/<name> URL for the same asset.

Both resolve to the same bytes (verified: 207949 for 1.2.0 zip).
Pretty URL is preferred: filename is visible in the URL (better for
WP admin «View version details» and manual downloads), consistent
across Gitea instances (UUID format is git.netranking.ru-specific
Postgres attachment storage).

Also: switch `echo "$VAR" | jq` to `jq ... <<< "$VAR"`
herestring for CREATE_RESPONSE parsing — macOS /bin/echo can
interpret backslash-escapes in multi-line JSON bodies and corrupt
jq input.

wp-plugin-info.json for 1.2.0 patched in-place to use the pretty URL
for consistency with future releases. Both URLs continue to work;
domработница.рус's next PUC poll will refresh its local transient
to the pretty URL (version comparison stays 1.2.0 == 1.2.0, so no
update notice).

Closes cf7stg-pmf (T20).

release.sh

@@ -182,7 +182,7 @@ CREATE_RESPONSE="$(curl -fsSL \
     -H "Content-Type: application/json" \
     -d "$CREATE_PAYLOAD")"
 
-RELEASE_ID="$(echo "$CREATE_RESPONSE" | jq -r '.id')"
+RELEASE_ID="$(jq -r '.id' <<< "$CREATE_RESPONSE")"
 [[ -n "$RELEASE_ID" && "$RELEASE_ID" != "null" ]] \
   || fail "Gitea create-release response missing id: $CREATE_RESPONSE"
 
@@ -192,14 +192,28 @@ log "Created Gitea release id=$RELEASE_ID"
 
 log "Uploading asset $ZIP_NAME to release id=$RELEASE_ID"
 
-UPLOAD_RESPONSE="$(curl -fsSL \
+curl -fsSL \
     -X POST "${GITEA_API}/repos/${REPO_OWNER}/${REPO_NAME}/releases/${RELEASE_ID}/assets?name=${ZIP_NAME}" \
     -H "Authorization: token ${TOKEN}" \
-    -F "attachment=@${ZIP_PATH};type=application/zip")"
+    -F "attachment=@${ZIP_PATH};type=application/zip" \
+    -o /dev/null
+
+# Gitea's asset upload response returns an internal /attachments/<uuid> URL,
+# but the release detail endpoint returns the pretty /releases/download/<tag>/<name>
+# URL for the same asset. Both resolve to the same bytes; the pretty URL is
+# preferred for readability and WP-admin UX.
+RELEASE_DETAIL="$(curl -fsSL \
+    "${GITEA_API}/repos/${REPO_OWNER}/${REPO_NAME}/releases/${RELEASE_ID}" \
+    -H "Authorization: token ${TOKEN}")"
+
+# Use herestring instead of `echo | jq`: `echo` on macOS may interpret
+# backslash-escapes in a multi-line release body, corrupting the JSON.
+DOWNLOAD_URL="$(jq -r --arg name "$ZIP_NAME" \
+    '.assets[] | select(.name == $name) | .browser_download_url' \
+    <<< "$RELEASE_DETAIL" | head -n 1)"
 
-DOWNLOAD_URL="$(echo "$UPLOAD_RESPONSE" | jq -r '.browser_download_url')"
 [[ -n "$DOWNLOAD_URL" && "$DOWNLOAD_URL" != "null" ]] \
-  || fail "Gitea asset upload response missing browser_download_url: $UPLOAD_RESPONSE"
+  || fail "release $RELEASE_ID has no asset named $ZIP_NAME"
 
 log "Asset uploaded: $DOWNLOAD_URL"