ci/publish: fix awk range producing empty release notes

The v0.0.5 publish run shipped to PyPI fine but emitted an empty
GitHub release body. Local reproduction confirmed the bug is in the
awk range pattern: `/^## \[$VERSION\]/,/^## \[/` collapses to a
single-line range whenever both regex match the same line. The
`## [0.0.5]` line matches both `/^## \[0.0.5\]/` (start) and `/^## \[/`
(end) simultaneously, so awk emits just that one header, then sed '$d'
strips it and writes an empty file. release-notes.md ended up empty
and the v0.0.5 GitHub release went out blank (backfilled by hand
post-publish).

Replace the range pattern with a state-flag walker that only marks
the section "open" on the `## [VERSION]` line and exits on the next
`## [` header. VERSION is passed via the awk command line preamble
and read from ENVIRON inside the script so the awk body has no
shell-quoting interaction. No more `sed '$d'` post-processing -
the awk itself stops at the boundary, so the output already excludes
the next version header.

Verified locally: `VERSION="0.0.5"` produces 16 lines starting with
`## [0.0.5] - 2026-04-29` and ending with the last Removed bullet,
no `## [0.0.4]` header. The fix lands in time for v0.0.6+.

Signed-off-by: Javier Tia <floss@jetm.me>

Author: jetm

.github/workflows/publish.yml

@@ -24,8 +24,13 @@ jobs:
 
       - name: Extract changelog section for this tag
         run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          awk "/^## \\[$VERSION\\]/,/^## \\[/" CHANGELOG.md | sed '$d' > release-notes.md
+          VERSION="${GITHUB_REF_NAME#v}" awk '
+            /^## \[/ {
+              if ($0 ~ "^## \\[" ENVIRON["VERSION"] "\\]") { p=1; print; next }
+              else if (p) exit
+            }
+            p { print }
+          ' CHANGELOG.md > release-notes.md
           echo "=== Release notes for ${GITHUB_REF_NAME} ==="
           cat release-notes.md