ci: address fourth Copilot follow-up

Cross-port of dunglas/mercure#1246 follow-up:

- Add `set -euo pipefail` to the Validate inputs step.
- Hardcode mode 100644 for deletion entries since the mode is purely
  formal when sha is null.
- Reword the verify_release_content comment to spell out that omitting
  the `require` keyword from the grep is what makes it match both
  block and single-line layouts.

Author: dunglas

.github/workflows/release.yaml

@@ -35,6 +35,7 @@ jobs:
         env:
           VERSION: ${{ inputs.version }}
         run: |
+          set -euo pipefail
           if [[ "${GITHUB_REF}" != "refs/heads/main" ]]; then
             echo "::error::release.yaml must be dispatched against refs/heads/main, got ${GITHUB_REF}"
             exit 1
@@ -90,8 +91,9 @@ jobs:
               printf '%s\n' "${sha}"
             fi
           }
-          # Match the frankenphp require entry in both `require ( ... )`
-          # block form and single-line `require x v...` form.
+          # The grep below deliberately omits the `require` keyword so
+          # it matches both `require ( ... )` block layout (where the
+          # entry is indented) and single-line `require x v...` layout.
           verify_release_content() {
             local ref="$1"
             if ! git show "${ref}:caddy/go.mod" 2>/dev/null \
@@ -263,8 +265,10 @@ jobs:
                     '{path: $path, mode: $mode, type: "blob", sha: $sha}'
                 done
                 for path in "${deleted[@]}"; do
-                  jq -nc --arg path "${path}" --arg mode "$(mode_for "${path}")" \
-                    '{path: $path, mode: $mode, type: "blob", sha: null}'
+                  # Deletions need a valid mode but it's purely formal —
+                  # the entry only removes the path from the tree.
+                  jq -nc --arg path "${path}" \
+                    '{path: $path, mode: "100644", type: "blob", sha: null}'
                 done
               } | jq -sc .
             )