feat: harden fullupgrade and document release workflow

Add set -euo pipefail, root checks, safer orphan cleanup, and a help
message to fullupgrade. Refresh the README and project notes to match
the current scripts and release process.

README.md

@@ -1,2 +1,79 @@
 # fullupgrade
 
+Minimal Bash tools for Arch Linux maintenance and Git release automation.
+
+## Overview
+
+This repository contains two small Bash scripts:
+
+- `fullupgrade`: updates an Arch Linux system and performs cleanup
+- `makerelease.sh`: merges `dev` into `main` and creates a release tag
+
+The project is intentionally small and focused on a simple, opinionated workflow.
+
+## Requirements
+
+- Bash
+- `pacman` for `fullupgrade`
+- `git` for `makerelease.sh`
+- root privileges for `fullupgrade`
+- a local Git repository with `dev` and `main` branches for `makerelease.sh`
+
+## `fullupgrade`
+
+`fullupgrade` performs the following steps:
+
+1. updates `archlinux-keyring`
+2. runs a full system synchronization with `pacman -Syu --noconfirm`
+3. removes orphaned packages if any are found
+4. cleans the pacman cache with `pacman -Sc --noconfirm`
+
+### Usage
+
+```bash
+sudo ./fullupgrade
+```
+
+### Notes
+
+- The script must be run as `root`.
+- It does not ask for confirmation.
+- It can remove packages and clean the package cache, so review the output carefully.
+
+## `makerelease.sh`
+
+`makerelease.sh` automates a simple Git release workflow:
+
+1. checks that the current branch is `dev`
+2. switches to `main`
+3. merges `dev` into `main`
+4. pushes `main`
+5. creates an annotated tag using the provided version and message
+6. pushes tags
+7. switches back to `dev`
+
+### Usage
+
+```bash
+./makerelease.sh VERSION "Release message"
+```
+
+### Example
+
+```bash
+./makerelease.sh 1.2.0 "Release 1.2.0"
+```
+
+### Notes
+
+- Run the script from a clean, local Git repository.
+- Make sure the `dev` branch contains the changes you want to release.
+- The script may fail if Git state is unexpected or if a tag already exists.
+
+## Status
+
+This repository is intentionally minimal. `fullupgrade` is hardened with `set -euo pipefail`, while `makerelease.sh` may still need additional validation and safeguards.
+
+## License
+
+GPLv3