tools/release.py: fail if worktree is dirty

Assisted-by: Claude Opus 4.5

Author: jlebon

tools/release.py

@@ -28,6 +28,9 @@ def main():
         if tag_exists(tag):
             die(f"Tag {tag} already exists")
 
+        if is_worktree_dirty():
+            die("Worktree is dirty, commit or stash changes first")
+
         step("Verifying Cargo.lock is in sync...")
         run("just", "lockcheck")
 
@@ -138,6 +141,11 @@ def tag_exists(tag: str) -> bool:
     return run_output("git", "tag", "-l", tag).strip() != ""
 
 
+def is_worktree_dirty() -> bool:
+    """Check if the git worktree has uncommitted changes."""
+    return run_output("git", "status", "--porcelain").strip() != ""
+
+
 def fetch_release_notes(tag: str) -> str:
     """Fetch auto-generated release notes from GitHub."""
     return run_output("gh", "api", "--method", "POST",