ci: delete latest version, not the file, before re-uploading

File-level DELETE leaves a ghost version directory that makes the
subsequent PUT 404 after a full 9-minute upload. Delete the whole
'latest' version, log the status code, and wait briefly before PUT.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -76,10 +76,21 @@ jobs:
           OWNER:          ${{ gitea.repository_owner }}
           BUNDLE:         ${{ steps.meta.outputs.bundle }}
         run: |
-          curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
+          set -euo pipefail
+          # Delete the whole "latest" version, not the file inside it.
+          # Deleting the file leaves a ghost version that makes PUT 404.
+          status=$(curl -sS -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token ${REGISTRY_TOKEN}" \
             -X DELETE \
-            "${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz" \
-            || true
+            "${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest")
+          echo "DELETE latest -> ${status}"
+          case "${status}" in
+            204|404) ;;
+            *) echo "unexpected DELETE status ${status}"; exit 1 ;;
+          esac
+          # Give Gitea a moment to finalize the version delete before
+          # the upload re-creates it under the same name.
+          sleep 2
           curl -fsSL -H "Authorization: token ${REGISTRY_TOKEN}" \
             --upload-file "${BUNDLE}" \
             "${REGISTRY_URL}/api/packages/${OWNER}/generic/vetting/latest/vetting-bundle.tar.gz"