Reuses the Docker image tag so both artifacts share the same
version identifier.

Assisted-by: Claude Opus 4.6 via Claude Code

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c39ac84..d69491f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
     branches: [main]
 
 permissions:
-  contents: read
+  contents: write
   packages: write
 
 jobs:
@@ -48,3 +48,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+      - if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release create "${{ steps.meta.outputs.version }}" --generate-notes