Publish tagged releases for mise installation

Package the commands in a tar archive with a bin directory so mise can
install them without asset or path options.  Validate the scripts before
publishing and keep pinned actions updated with Dependabot.

Author: knu

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check release asset
+        run: |
+          test -x git-word-diff-auto
+          sh -n git-word-diff-auto
+
+      - name: Package release
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          package_dir=$(mktemp -d "$RUNNER_TEMP/package.XXXXXX")
+          mkdir -p "$package_dir/bin"
+          install -m 755 git-word-diff-auto "$package_dir/bin/git-word-diff-auto"
+          tar -czf "$RUNNER_TEMP/git-word-diff-auto-${TAG#v}.tar.gz" -C "$package_dir" bin
+
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+        run: gh release create "$TAG" "$RUNNER_TEMP/git-word-diff-auto-${TAG#v}.tar.gz" --verify-tag --generate-notes