fix(release): env-bash shebang so release.sh runs on non-FHS systems (NixOS)

[adnaan]

Problem

release.sh starts with #!/bin/bash. On systems without a /bin/bash — notably NixOS, where bash lives under /run/current-system/sw/bin — running ./release.sh <version> fails with:

bad interpreter: /bin/bash: no such file or directory

and creates no tag, so the release silently no-ops. This bit the v0.4.0 cut: the script had to be re-run via an explicit /run/current-system/sw/bin/bash ./release.sh to actually tag.

Fix

One line: #!/bin/bash → #!/usr/bin/env bash, which resolves bash via PATH and works on NixOS and standard FHS systems alike.

Verification

• bash -n release.sh — syntax clean.
• ./release.sh (no args) — prints usage via the new shebang (confirms it resolves).

🤖 Generated with Claude Code

https://claude.ai/code/session_018M9pJSPmG6i1D8s6rpEV4h

[claude]

Review

This is a clean, minimal, correct fix.

Code quality / best practices

• #!/usr/bin/env bash is the standard portable shebang and is the right fix for the NixOS "no /bin/bash" failure described in the PR. No notes.

Potential bugs

• None. This is a strict improvement — env bash resolves via PATH on every system that also has /bin/bash, so nothing regresses on standard FHS Linux/macOS.

Performance

• N/A for a shebang change.

Security

• Using env bash instead of an absolute path means whichever bash is first on PATH gets executed, rather than a fixed system binary. This is the standard tradeoff for env-based shebangs (also why tools like shellcheck/checkbashisms and most shells recommend it for portability) and is a non-issue here since release.sh is a maintainer-run local script, not something invoked from an untrusted or attacker-influenced PATH (e.g., CI runners with fixed images, or a maintainer's own shell). Not a concern for this use case.

Test coverage

• No automated test, but that's appropriate for a one-line shebang fix in a shell script — the PR description notes manual verification (bash -n release.sh for syntax, and running ./release.sh with no args to confirm the new shebang resolves and usage prints). That's sufficient here.

Overall: LGTM.