ci: gate the release on vet and tests

The workflow only built and published, so a tag went straight to
binaries on the releases page with nothing having run against the code
first.

A test job now runs go vet and go test, and build depends on it; release
depends on build, so a tag that fails publishes nothing.

Only runs at release time — a push or pull request is still unchecked.

.github/workflows/release.yml

@@ -6,7 +6,26 @@ on:
       - 'v*'
 
 jobs:
+  # Gates the build, so a tag that fails here publishes no binaries. The suite
+  # covers the API client against a stub server, the Update state machine, and
+  # View rendering — all three are pure enough to test without a terminal.
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test
+        run: go test ./...
+
   build:
+    needs: test
     runs-on: ubuntu-latest
     strategy:
       matrix: