ci(release): fix tag env, upgrade actions, add release permissions

.gitea/workflows/test.yml

@@ -1,3 +1,6 @@
+# Test — Python. Runs on push and pull request to development. Never on main.
+# The 80 % coverage gate lives in pyproject.toml (addopts --cov-fail-under=80),
+# so `uv run pytest` enforces it here exactly as it does locally.
 name: Test
 
 on:
@@ -11,12 +14,12 @@ jobs:
   test:
     runs-on: fedora
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Set up Python and uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
         with:
-          python-version: "3.14"
+          python-version: "3.14" # match requires-python in pyproject.toml
           enable-cache: true
           cache-dependency-glob: "uv.lock"