ci: deepen the clone in the release step; the plugin fetches depth 1 regardless

Pipeline 11 recorded nothing: the clone plugin ran `git fetch --depth=1
--filter=tree:0` with depth: 100 set, so `git log <serving>..<this>`
could not name the commit it replaced. The repo is anonymously readable
on Gitea, so the release step deepens by 100 itself before it renders
the notes. The clone setting goes back to what it was.

.woodpecker.yml

@@ -7,9 +7,7 @@ clone:
   git:
     image: woodpeckerci/plugin-git
     settings:
-      # 100, not 1: the release step renders `git log <serving>..<this>` for the
-      # release channel, and a depth-1 clone cannot name the commit it replaced.
-      depth: 100
+      depth: 1
 
 steps:
   test:
@@ -92,6 +90,12 @@ steps:
         done
         test -x usr/local/bin/courier || { echo "courier CLI not found in any layer of courierd@$$D"; exit 1; }
         mv usr/local/bin/courier ./courier; rm -rf usr manifest.json
+      # The clone is `--depth=1 --filter=tree:0` whatever `depth:` says (measured on
+      # pipeline 11: the plugin fetched depth 1 with depth: 100 set), and the notes are
+      # `git log <serving>..<this>`, which needs the commit it replaced. The repo is
+      # anonymously readable on Gitea, so deepen it here; 100 covers any gap between
+      # two deploys, and the fallbacks below say so if it does not.
+      - git fetch -q --deepen=100 origin 2>/dev/null || git fetch -q --unshallow origin 2>/dev/null || true
       - |
         set -- hush prod ${CI_COMMIT_SHA} \
           -image registry.threesix.ai/hush/api:${CI_COMMIT_SHA:0:8} -substrate k3s \