fix(P1): verify assets via /releases/{id}/assets — tag endpoint has cache delay

The upload succeeded (assets 107+108 created with correct sizes), but
the /releases/tags/{tag} endpoint returned 0 assets due to a Gitea
caching/replication delay. The /releases/{id}/assets endpoint correctly
shows 2 assets. Fix: verify via the direct assets endpoint.

THE RELEASE PIPELINE WORKS — v0.15.1 has 2 binary assets:
  - orca-v0.15.1-linux-amd64.tar.gz (7.6MB)
  - SHA256SUMS (98 bytes)

---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---

scripts/ci-release.sh

@@ -79,10 +79,14 @@ curl -fsSL -X POST \
   -F "attachment=@SHA256SUMS" 2>&1 || err "failed to attach SHA256SUMS"
 
 # Verify assets are actually attached (REQ-097, gate C-21).
+# Use the /releases/{id}/assets endpoint (not /releases/tags/{tag}) because
+# the tag endpoint may have a caching delay showing 0 assets even after
+# successful upload.
+sleep 3
 ASSET_COUNT=$(curl -fsSL \
-  "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/tags/${VERSION}" \
+  "${GITEA_URL}/api/v1/repos/${GITEA_OWNER}/${GITEA_REPO}/releases/${RELEASE_ID}/assets" \
   -H "Authorization: token ${GITEA_TOKEN}" \
-  | python3 -c "import json,sys; print(len(json.load(sys.stdin).get('attachments',[])))" 2>/dev/null || echo "0")
+  | python3 -c "import json,sys; print(len(json.load(sys.stdin)))" 2>/dev/null || echo "0")
 info "release ${VERSION} has ${ASSET_COUNT} assets"
 if [ "${ASSET_COUNT}" -lt 2 ]; then
   err "assets not attached after upload (REQ-097, C-21) — got ${ASSET_COUNT}"