fix(release): upload Linux release assets from the manylinux container

gh release upload shells out to git, which refuses the root-owned container
workspace with 'dubious ownership'. Mark the workspace safe and pass --repo so
gh resolves the release without inspecting the local git remote.

Author: Goldziher

.github/workflows/publish.yaml

@@ -490,7 +490,11 @@ jobs:
             echo "::error::Archive not found: $archive"
             exit 1
           fi
-          gh release upload "$tag" "$archive" --clobber
+          # The container runs as root but the workspace is owned by the runner
+          # uid; gh shells out to git, which refuses with "dubious ownership".
+          # Mark it safe and pass --repo so gh never needs the local git remote.
+          git config --global --add safe.directory "${GITHUB_WORKSPACE:-/__w/basemind/basemind}"
+          gh release upload "$tag" "$archive" --clobber --repo "$GITHUB_REPOSITORY"
 
   checksums:
     name: Generate and upload checksums