Give release.yaml's test job the database ci.yaml already has

v0.11.0 was tagged and published nothing: release.yaml runs the same
`make fmt lint test` as ci.yaml, and the Postgres service the suite now
needs was added to ci.yaml alone. Its test job failed on the missing
TERDUT_TEST_DSN, and binaries, image, chart and scan-image are all
downstream of it, so they skipped. The tag stays -- a published tag is
immutable and moving one is how this repo ran v0.4.0 for ten days while
every artifact said v0.3.0 -- so the fix is the next version.

The two workflows carry their own copies of this block because a service
container cannot be factored into the Makefile the way the checks are.
That is the second copy, and the reason this failed: the gate is one
target, but what the gate needs to run is declared per workflow.

.gitea/workflows/release.yaml

@@ -35,6 +35,27 @@ jobs:
         - go-mod-cache:/go/pkg/mod
         - go-build-cache:/root/.cache/go-build
         - gobin-cache:/go/bin
+
+    # The same database ci.yaml's test job gets, for the same reason: `make test` needs a
+    # real Postgres and fails without TERDUT_TEST_DSN rather than skipping. This job is
+    # the gate every publishing job below hangs off, so it has to be able to run the
+    # suite -- v0.11.0 was tagged with the service here missing and published nothing.
+    services:
+      postgres:
+        image: postgres:17-alpine
+        env:
+          POSTGRES_USER: terdut
+          POSTGRES_PASSWORD: terdut
+          POSTGRES_DB: terdut_test
+        options: >-
+          --health-cmd "pg_isready -U terdut -d terdut_test"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+
+    env:
+      TERDUT_TEST_DSN: postgres://terdut:terdut@postgres:5432/terdut_test?sslmode=disable
+
     steps:
       - name: Checkout
         env: