fix(release): an empty code block in the notes, and a check for the next one

[youhide]

Reported by the first person to read the v0.1.0 notes.

`ghcr.io/youhide/oxinit:demo` tracks `main` if you would rather have the
latest.

```bash
```          <- this

### Install

It came from editing the heredoc that writes the notes by string
substitution: my insertion ended with an opening fence directly above a
closing fence that was already there, so the two paired up around
nothing. The diff looked fine.

Markdown has no compiler, so CI is one now

.github/scripts/check-release-notes.py renders the header exactly as
the workflow does and fails on unbalanced fences or empty code blocks —
the two mistakes that survive review by looking correct in a diff.

The published v0.1.0 notes were edited in place.

The release itself

Worked on its first run, and is verified against what was published
rather than what was built:

• Both tarballs downloaded; both sha256 match.
• oxinit, oxctl and oxlogd out of the x86_64 tarball report 0.1.0.
• The same out of the aarch64 tarball, under emulation.
• ghcr.io/youhide/oxinit:v0.1.0 pulls anonymously.

A pattern, not three slips

This is the third time in this project the failure was editing text
without looking at the output, and the second time it reached somebody.
Named as such in ROADMAP.