fix(ci/release): make _release_notes_path POSIX-sh safe (deb/decky attach runs under dash)

The v0.19.0 deb + decky release-attach steps source gitea-release.sh under `sh` (dash) and
died with "Bad substitution" at _release_notes_path's `${BASH_SOURCE[0]:-$0}` — a bash array
subscript dash rejects. So those legs never attached their assets to the release (the bash
legs — apple, android, rpm — were fine, which is why the body still seeded and the DMG/.ipa
attached). CI always sources this from the repo root, so resolve the notes as
docs/releases/<tag>.md relative to CWD and drop $BASH_SOURCE entirely. Verified under dash.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/ci/gitea-release.sh

@@ -40,12 +40,14 @@ _urlencode() { python3 -c 'import urllib.parse,sys;print(urllib.parse.quote(sys.
 #   else print nothing. This file is the single source of truth for a stable release's body
 #   (authored as part of the version bump, before the tag is pushed — see docs/releases/README.md),
 #   so the Gitea release is born WITH its notes instead of being PATCHed noteless-then-late.
-#   Resolves relative to this script (scripts/ci/ -> repo root); canary/rc tags have no such file,
-#   which is intended (they get no curated body).
+#   canary/rc tags have no such file, which is intended (they get no curated body).
+#
+#   Resolved relative to CWD: every caller sources this as `. scripts/ci/gitea-release.sh` from the
+#   repo root, so the notes are always docs/releases/<tag>.md from here. Do NOT use ${BASH_SOURCE[0]}
+#   — the deb + decky attach steps run under POSIX sh (dash), where an array subscript is a fatal
+#   "Bad substitution" (it silently broke the v0.19.0 deb/decky release-attach).
 _release_notes_path() {
-  local root notes
-  root="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../.." && pwd)"
-  notes="$root/docs/releases/$1.md"
+  local notes="docs/releases/$1.md"
   [ -f "$notes" ] && printf '%s' "$notes"
 }