fix(ci): pass release notes by file, not shell interpolation

.github/workflows/release.yaml

@@ -66,11 +66,6 @@ jobs:
             --from "$(git describe --tags --abbrev=0)" \
             --to HEAD > /tmp/preamble.md
           cat /tmp/preamble.md
-          {
-            echo 'body<<RELEASE_NOTES_EOF'
-            cat /tmp/preamble.md
-            echo 'RELEASE_NOTES_EOF'
-          } >> "$GITHUB_OUTPUT"
 
       - name: Summary
         run: |
@@ -94,12 +89,32 @@ jobs:
 
           # --generate-notes appends the categorised commit list, grouped per
           # .github/release.yml, beneath our preamble.
+          #
+          # Use --notes-file rather than passing the body through a GitHub
+          # expression: interpolating it into the shell makes bash treat its
+          # backticks as command substitution, which silently ate every code span
+          # and the fenced block. (A literal expression cannot appear even in a
+          # comment here — Actions evaluates it and fails to parse the file.)
           gh release create "$VERSION" \
             --title "$VERSION" \
-            --notes "${{ steps.notes.outputs.body }}" \
+            --notes-file /tmp/preamble.md \
             --generate-notes \
             --verify-tag
 
+      # A tag pushed with GITHUB_TOKEN does not trigger other workflows —
+      # GitHub suppresses that to prevent recursion. So the image build has to be
+      # dispatched explicitly, or the release would have no versioned image and
+      # kube-workspaces/deploy would refuse to release against it.
+      - name: Build the release image
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          gh workflow run docker.yml --ref "$VERSION"
+          echo "::notice::dispatched the image build for $VERSION"
+
       - name: Dry run notice
         if: ${{ inputs.dry_run }}
         run: |