security: add actions permissions and standardize release note style

Author: Kingson4Wu

.claude/commands/release.md

@@ -121,25 +121,21 @@ rm -rf dist/tmp
 ```bash
 PREV_TAG="$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || git rev-list --max-parents=0 HEAD)"
 cat <<'EOF' > /tmp/release-notes.md
-## What's Changed
+Changes
+feat+fix: release hardening and cross-platform install packaging (post-${VERSION})
 
-## Added
-- ...
-
-## Changed
-- ...
+Install / update (macOS)
+curl -fsSL https://raw.githubusercontent.com/OctopusGarage/git-auto-sync/main/install.sh | bash
 
-## Fixed
-- ...
+Pin this version with GIT_AUTO_SYNC_VERSION=${VERSION}. See README.md for dev, deploy, and release.
 
-**Full Changelog**
-https://github.com/OctopusGarage/git-auto-sync/compare/${PREV_TAG}...${VERSION}
+Prefer an AI assistant? Paste this to ChatGPT / Claude / Gemini (or a shell agent):
 
-**Install**
-curl -fsSL https://raw.githubusercontent.com/OctopusGarage/git-auto-sync/main/install.sh | bash
-
-**Install (Windows)**
-powershell -ExecutionPolicy ByPass -c "irm https://raw.githubusercontent.com/OctopusGarage/git-auto-sync/main/install.ps1 | iex"
+Install "git-auto-sync" on my Mac for me (open-source, macOS-only). Download the latest
+release tarball from https://github.com/OctopusGarage/git-auto-sync/releases/latest, extract it, read the
+INSTALL.md inside, and follow it. Guide me step by step and ask me for anything it needs
+(like my Telegram bot token).
+Full Changelog: ${PREV_TAG}...${VERSION}
 EOF
 ```
 

.github/workflows/ci.yml

@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
   pull_request:

README.md

@@ -155,16 +155,24 @@ and cross-platform validation.
 Stop immediately on first failure and report the blocked step plus fix.
 ```
 
-Copyable installation prompt for AI on any platform:
+Copyable release note sample and AI install assistant prompt:
 
 ```text
-Install git-auto-sync using the latest release package and do not fetch the full source.
+Changes
+feat+fix: release hardening and cross-platform install packaging
 
-macOS / Linux:
+Install / update (macOS)
 curl -fsSL https://raw.githubusercontent.com/OctopusGarage/git-auto-sync/main/install.sh | bash
 
-Windows:
-powershell -ExecutionPolicy ByPass -c "irm https://raw.githubusercontent.com/OctopusGarage/git-auto-sync/main/install.ps1 | iex"
+Pin this version with GIT_AUTO_SYNC_VERSION=vX.Y.Z. See README.md for dev, deploy, and release.
+
+Prefer an AI assistant? Paste this to ChatGPT / Claude / Gemini (or a shell agent):
+
+Install "git-auto-sync" on my Mac for me (open-source, macOS-only). Download the latest
+release tarball from https://github.com/OctopusGarage/git-auto-sync/releases/latest, extract it, read the
+INSTALL.md inside, and follow it. Guide me step by step and ask me for anything it needs
+(like my Telegram bot token).
+Full Changelog: v0.1.6...v0.1.7
 ```
 
 For manual release scripts, run the version bump and release flow in that file.