Add Woodpecker tagged-release workflows

docs/consumers/delivery.md

@@ -79,3 +79,44 @@ fmt.Println(result.State, result.ReleaseURL)
 See the [CLI contract](../cli.md), [configuration reference](../config.md),
 and [Gitea integration guide](../integrations/gitea.md) for exact settings,
 exit codes, and transport behavior.
+
+## Woodpecker tag workflows
+
+Maintained workflow examples are available for source-only and binary delivery:
+
+- [Source-only tag workflow](../../examples/woodpecker/tag-delivery-source-only.yml)
+- [Binary tag workflow](../../examples/woodpecker/tag-delivery-binary.yml)
+
+Copy one into the consumer repository's `.woodpecker/` directory. In its
+matrix entry, set `GO_IMAGE` to a Go image compatible with the consumer module
+and replace `RELEASEKIT_SOURCE` with an immutable ReleaseKit commit. The
+examples deliberately contain no claimed published ReleaseKit pin. Configure
+the Woodpecker repository secret `releasekit_gitea_token`; the workflow maps it
+to `RELEASEKIT_GITEA_TOKEN` only for the delivery step. The repository also
+needs a `delivery` profile using the default `RELEASEKIT_GITEA_TOKEN` variable.
+The binary profile must declare its build targets.
+
+The tag workflow fetches the event tag, verifies that the tag resolves to
+`CI_COMMIT_SHA`, and checks out that commit detached. Woodpecker shares the
+repository workspace between sequential steps, so the installed executable,
+Go caches, build outputs, and build receipt remain available to later steps.
+The workflow keeps its `.releasekit/` directory out of Git status using the
+checkout's local exclude file.
+
+Preparation can access the Go module proxy to install the pinned ReleaseKit
+executable. The binary workflow also runs `go mod download` before the build.
+The later `releasekit build` command runs with `GOPROXY=off` and
+`GOTOOLCHAIN=local`; its declared binary targets and receipt are placed in
+`.releasekit/assets`. Delivery then passes that directory with `--assets`.
+The source-only workflow skips this build step and sends the committed note
+page directly. Neither template runs `check` or `publish`.
+
+Woodpecker runs delivery after the tag event, independently from the source
+publication result. Read its workflow status as delivery status: a delivery
+failure does not undo source publication. A failed, partial, or uncertain run
+can be inspected and retried against the same immutable tag and commit; do not
+move the tag to make a retry pass. See
+[Woodpecker's environment reference](https://woodpecker-ci.org/docs/usage/environment)
+for the runner-provided tag and commit variables and
+[workflow syntax](https://woodpecker-ci.org/docs/usage/workflow-syntax) for tag
+events, sequential steps, and the shared workspace.