fix: pre-release script macOS compat and add no-retag docs

- Fix realpath --relative-to not available on macOS
- Fix grep pipeline exit code with set -euo pipefail
- Add warning to RELEASE.md about never moving tags post-release

RELEASE.md

@@ -119,6 +119,18 @@ The release process is fully automated via [`.github/workflows/release.yml`](.gi
    - Attaches all binaries and installer packages
    - Uses extracted changelog content as release notes
 
+## Important: Never Move a Tag After Release
+
+**Never force-push or move a tag after the release pipeline has started.** Moving a tag
+causes GitHub to regenerate source tarballs with different SHA checksums, which breaks
+every downstream package manager that already cached the original checksums:
+
+- **AUR/Homebrew/Chocolatey**: checksum verification failures for end users
+- **Launchpad PPA**: rejects uploads with the same version but different file contents
+- **crates.io**: already published and cannot be re-published with the same version
+
+If a fix is needed after tagging, **create a patch release** (e.g., `v1.1.1`) instead.
+
 ## Release Checklist
 
 Before pushing the tag, ensure:

scripts/pre-release-check.sh

@@ -68,7 +68,7 @@ else
   fail "CHANGELOG.md missing comparison link for $VERSION"
 fi
 
-UNRELEASED_CONTENT=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{found=0} found{print}' CHANGELOG.md | grep -v '^$' | head -1)
+UNRELEASED_CONTENT=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{found=0} found{print}' CHANGELOG.md | grep -v '^$' | head -1 || true)
 if [ -z "$UNRELEASED_CONTENT" ]; then
   pass "[Unreleased] section is empty (content moved to $VERSION)"
 else
@@ -112,10 +112,10 @@ if [ "$CARGO_BENCHES" -gt 0 ]; then
   fi
 fi
 
-# Check that all include!() / assets referenced at compile time are in Dockerfile
+# Check that all include_bytes!() assets referenced at compile time are in Dockerfile
 for asset in $(grep -roh 'include_bytes!("[^"]*")' src/ 2>/dev/null | sed 's/include_bytes!("//;s/")//' | sort -u); do
-  # Resolve relative paths from src/
-  resolved=$(cd src && realpath --relative-to=.. "$asset" 2>/dev/null || echo "$asset")
+  # Resolve relative paths from src/ (portable, no GNU realpath needed)
+  resolved=$(cd src && python3 -c "import os.path; print(os.path.relpath(os.path.abspath('$asset'), '..'))" 2>/dev/null || echo "$asset")
   if grep -q "$resolved\|$(basename "$resolved")" Dockerfile; then
     pass "Dockerfile includes compile-time asset: $resolved"
   else