ci: gate release publishing to final tags, upstream-shape the tarball

RC tags (a v* tag with a prerelease suffix) now publish nothing at
all — the release job joins the crates.io job behind the same gate;
only final release tags attach artifacts.

The tarball loses the 'orig' qualifier: 'orig' is the Debian side's
name for the imported upstream tarball (gbp/uscan rename it on
import), not something upstream ships. The asset is
pkh-<version>.tar.gz over a versioned pkh-<version>/ prefix, the
conventional upstream shape.

.github/workflows/ci.yml

@@ -124,14 +124,17 @@ jobs:
           if-no-files-found: error
 
   release:
-    # Publishes the release artifacts on a v* tag: the Debian orig
-    # tarball, the packed snap, and their checksums. Gitea's automatic
-    # per-tag archive is a git-tree snapshot named after the raw tag —
-    # not a dpkg-shaped orig (the version must not carry a hyphen; the
-    # Debian encoding of a prerelease is 0.2.0~rc1). Nothing is
-    # published beyond this repo's release page: no crates.io (see the
-    # publish job), no snap store.
-    if: startsWith(github.ref, 'refs/tags/v')
+    # Publishes the release artifacts on a release tag (a v* tag without
+    # a prerelease suffix — RC tags publish nothing, like the crates.io
+    # job): the upstream tarball, the packed snap, and their checksums.
+    # Gitea's automatic per-tag archive is a git-tree snapshot named
+    # after the raw tag; this produces the conventional upstream shape
+    # (pkh-<version>.tar.gz, versioned pkh-<version>/ prefix) attached
+    # to a release page. Nothing is published beyond this repo: no
+    # crates.io (see the publish job), no snap store. The Debian
+    # packaging renames the tarball to .orig.tar.gz on import, as
+    # gbp/uscan always do for upstream releases.
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')
     needs: [build, snap]
     runs-on: ubuntu-latest
     container:
@@ -146,22 +149,20 @@ jobs:
     - uses: actions/download-artifact@v3
       with:
         name: snap
-    - name: Build the orig tarball
+    - name: Build the upstream tarball
       run: |
         tag="${GITHUB_REF_NAME#v}"
-        debver="${tag/-/~}"
-        git archive --format=tar.gz --prefix="pkh-${debver}/" \
-          -o "pkh_${debver}.orig.tar.gz" HEAD
-        sha256sum pkh_${debver}.orig.tar.gz pkh_*_amd64.snap > sha256sums.txt
+        git archive --format=tar.gz --prefix="pkh-${tag}/" \
+          -o "pkh-${tag}.tar.gz" HEAD
+        sha256sum "pkh-${tag}.tar.gz" pkh_*_amd64.snap > sha256sums.txt
     - name: Create or get the release
       id: release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
         api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
-        tag="$GITHUB_REF_NAME"
-        case "$tag" in *-*) pre=true;; *) pre=false;; esac
-        body="{\"tag_name\":\"$tag\",\"name\":\"pkh $tag\",\"body\":\"Release artifacts for $tag: the Debian orig tarball, the packed snap and their checksums.\",\"draft\":false,\"prerelease\":$pre}"
+        tag="${GITHUB_REF_NAME#v}"
+        body="{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"pkh $tag\",\"body\":\"Release artifacts for $tag: the source tarball, the packed snap and their checksums.\",\"draft\":false,\"prerelease\":false}"
         release_id=$(curl -sf -X POST \
           -H "Authorization: token $GITHUB_TOKEN" \
           -H "Content-Type: application/json" \
@@ -180,7 +181,7 @@ jobs:
         RELEASE_ID: ${{ steps.release.outputs.release_id }}
       run: |
         api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
-        for f in pkh_*.orig.tar.gz pkh_*_amd64.snap sha256sums.txt; do
+        for f in pkh-*.tar.gz pkh_*_amd64.snap sha256sums.txt; do
           echo "attaching $f"
           curl -sf -X POST \
             -H "Authorization: token $GITHUB_TOKEN" \