Record every hush release on the courier release channel

Two steps after deploy: crane exports the courier CLI out of courier's
own (distroless) image, pinned by tag and digest, and alpine/git runs
`courier deployed hush prod $CI_COMMIT_SHA` as the `releases` agent —
one immutable version of releases/hush.prod carrying git log
<serving>..<this>, and one message on `deploys` keyed on that version.
The deploy step writes the image that was serving to .prev-sha before
`set image`, so the notes are what replaced what. Clone depth goes
1 → 100 so that log can be rendered. The credential is the Woodpecker
secret courier_releases_token, scoped to the alpine/git image and push
events. Same call every other substrate makes — orchard9-k3sf
scripts/lib/release.sh is the reference.

.woodpecker.yml

@@ -7,7 +7,9 @@ clone:
   git:
     image: woodpeckerci/plugin-git
     settings:
-      depth: 1
+      # 100, not 1: the release step renders `git log <serving>..<this>` for the
+      # release channel, and a depth-1 clone cannot name the commit it replaced.
+      depth: 100
 
 steps:
   test:
@@ -51,6 +53,9 @@ steps:
   deploy:
     image: bitnami/kubectl:latest
     commands:
+      # What is serving NOW, before it is replaced: the left edge of the release
+      # notes and the `prev_sha` on the record. A first deploy leaves it empty.
+      - prev="$(kubectl -n projects get deployment hush -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null || true)"; prev="$${prev##*:}"; echo "$${prev%%@*}" > .prev-sha
       - kubectl set image deployment/hush hushd=registry.threesix.ai/hush/api:${CI_COMMIT_SHA:0:8} -n projects
       - kubectl rollout status deployment/hush -n projects --timeout=120s
       # Prove the rolled pod actually serves, not merely that it became Ready.
@@ -60,3 +65,43 @@ steps:
     when:
       branch: main
       event: push
+
+  # The release channel. Two steps because courier's image is distroless — the
+  # binary is exported out of it, then run from an image that has sh and git.
+  # `courier deployed` appends a version to the document releases/hush.prod
+  # (the changelog, `git log <serving>..<this>`) and posts one message on the
+  # `deploys` topic, as the `releases` agent, whose credential can send and do
+  # nothing else. The same call every other substrate makes — see
+  # orchard9-k3sf scripts/lib/release.sh; this is the Woodpecker copy.
+  fetch-courier:
+    image: gcr.io/go-containerregistry/crane:debug
+    commands:
+      - crane export registry.threesix.ai/courier/courierd:3d490785@sha256:9d1ce76216a93f3d3808fc208179aaa2eb6c3eda20332095a28c3893b2ff5bdf - | tar -xf - usr/local/bin/courier
+      - mv usr/local/bin/courier ./courier && rmdir -p usr/local/bin 2>/dev/null || true
+    when:
+      branch: main
+      event: push
+
+  release:
+    image: alpine/git
+    environment:
+      COURIER_URL: https://courier.orchard9.ai
+      COURIER_TOKEN:
+        from_secret: courier_releases_token
+    commands:
+      - |
+        set -- hush prod ${CI_COMMIT_SHA} \
+          -image registry.threesix.ai/hush/api:${CI_COMMIT_SHA:0:8} -substrate k3s \
+          -by "woodpecker pipeline ${CI_PIPELINE_NUMBER}" -link "${CI_PIPELINE_URL}"
+        prev="$$(cat .prev-sha 2>/dev/null || true)"
+        if [ -n "$$prev" ] && [ "$$prev" != "${CI_COMMIT_SHA:0:8}" ]; then
+          set -- "$$@" -prev "$$prev" -notes-from-git -repo .
+        elif [ -n "$$prev" ]; then
+          set -- "$$@" -prev "$$prev" -notes "re-roll of ${CI_COMMIT_SHA:0:8}: the same build, rolled again"
+        else
+          set -- "$$@" -notes "first recorded release of hush to prod"
+        fi
+        ./courier deployed "$$@"
+    when:
+      branch: main
+      event: push