fix: release 改用 gh release create、ci 添加 permissions: contents: read

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -7,6 +7,9 @@ on:
     tags-ignore:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   frontend:
     name: 前端检查 (TypeScript + Lint + Test)

.github/workflows/release.yml

@@ -32,9 +32,9 @@ jobs:
       - name: Tauri Build
         run: npx tauri build
 
-      - name: 上传安装包到 Release
+      - name: 创建 Release 并上传安装包
         run: |
           $installer = Get-ChildItem -Path "src-tauri\target\release\bundle\nsis\*.exe" | Select-Object -First 1
-          gh release upload $env:GITHUB_REF_NAME "$installer" --clobber
+          gh release create $env:GITHUB_REF_NAME "$installer" --title "$env:GITHUB_REF_NAME" --generate-notes
         env:
           GH_TOKEN: ${{ github.token }}