Let the release skill drive this repo, and let make drive the pipeline

The release skill only knew repos that deploy an image through a wrapper
chart. terdut-tui publishes binaries to a Gitea release and nothing else,
so its first two releases were cut by hand. It now has a .release.conf
saying KIND=binary, which the skill treats as gate, tag, wait for the
pipeline, then check what was published.

The gate had to exist as make targets for that: fmt, lint and test, the
same three the other repos have. ci.yaml and release.yaml now call them
instead of carrying their own copy of gofmt, vet and the tests, so a green
gate locally and a green pipeline are the same code and cannot drift. The
gofmt handling moved over as written, including the comment on why both of
its failure modes need catching; both fail the target, checked with a
misformatted file and an unparseable one.

The binaries job calls make dist too. DIST_TARGETS is now the one place
that says what a release contains, and dist-assets prints the names dist
builds so the skill can verify the published release against a list
instead of a count. The names are unchanged, and they are the self-updater's
contract with every installed binary: internal/updater matches
terdut-tui-<tag>-<goos>-<goarch> exactly.

CLAUDE.md gains a Release section, including that the annotated tag's
message is what appears on the release page.

Not run in the pipeline yet: make is in the golang image, as terdut-server's
CI relies on, but this repo's workflows only exercise it on the push that
carries this commit, and make dist only on the next tag. A failure in the
release workflow's test job stops the publish rather than shipping
something unchecked.

CLAUDE.md

@@ -23,6 +23,25 @@ All user actions target incidents. Two server behaviours the UI has to respect:
 manual resolve is **terminal** (hence the confirmation prompt), and snooze is the
 non-destructive "not now" alternative.
 
+## Release
+
+Say **"Release"** (or "Release X.Y.Z") and the `release` skill runs it. This repo is
+`KIND=binary` in `.release.conf`: it publishes binaries to a Gitea release and has no image,
+chart or wrapper-chart PR. The run is gate, commit, push, tag, wait for `release.yaml`, then
+`verify-release`. Preconditions and the plan, without side effects:
+
+```sh
+~/.claude/skills/release/scripts/release-preflight          # state + suggested version
+~/.claude/skills/release/scripts/release-preflight vX.Y.Z   # validate that release
+```
+
+- `make fmt lint test` is the gate, and it **is** what `ci.yaml` and `release.yaml` run.
+- `make dist VERSION=vX.Y.Z` builds the four binaries; `make dist-assets` lists their names.
+  The pattern `terdut-tui-<tag>-<goos>-<goarch>` is the self-updater's contract with every
+  installed binary, so changing it breaks self-update.
+- **The annotated tag's message becomes the release notes** (`release.yaml` copies it, minus
+  its subject line). Write it for a reader of the release page. Never move a published tag.
+
 ## Tech stack
 
 - Go 1.25+