README: how a release is made

The repository had no written release procedure: four versions were
published through CI with no tag and no notes, and the next one was about
to go the same way. This is imsd's shape, in the README because there is no
AGENTS.md here: a push releases when the version changes, the range ends in
a bump commit, the bump commit carries a signed tag with the release notes,
and the notes are a Forgejo release.

README.md

@@ -62,6 +62,45 @@ The `focal64` trustlet is proprietary and is not in this repo. It is
 extracted from the device's own stock Android partition on first boot by the
 `fp6-vendor-blobs` mechanism, the same way other firmware in fp6-img is.
 
+## Releases
+
+Every push to `main` is built and tested by CI, which then publishes the
+apks to the Forgejo Alpine registry that installed phones already point at.
+CI treats the registry's "already published" answer as nothing to do, so a
+push publishes only a package version new to the registry. The package
+version is `pkgver-rpkgrel`: `pkgver` is the `Version` constant in
+`interfaces/Fingerprintd.cppm`, `pkgrel` is the APKBUILD's and stays at 0.
+An installed phone picks a published version up with plain `apk upgrade`.
+
+From 0.2.6 on, a release is a range of commits ending in a bump commit
+titled `fingerprintd X.Y.Z` that changes only the version: the constant and
+the APKBUILD's `pkgver`. Each release is tagged `vX.Y.Z` on its bump commit
+(signed, annotated) with the release notes as the tag message, and
+published as a Forgejo release of the same name and text. No version
+before 0.2.6 has a tag or release notes. The notes are written for the
+people whose phones will upgrade:
+
+```
+fingerprintd X.Y.Z
+
+## New
+
+- **What a user can now do.** One bullet per change, the most important
+  first, with anything the user has to do inside the bullet.
+
+## Fixes
+
+- **What went wrong, in the user's terms.** What they saw, what changes,
+  what to do.
+```
+
+A section with nothing in it is left out, and so is behaviour the release
+does not change. Versioning, from 0.2.6 on, is `MAJOR.MINOR.PATCH`: the
+patch number counts releases, fixes and features alike; the minor number
+moves when a release changes what a user can rely on the daemon for; the
+major number moves when a release changes what an installed phone does
+without being asked.
+
 ## License
 
 GPL-3.0-only, see LICENSE.