Restore pruned releases and verify CI publishing with v0.2.12

- Host root filesystem was expanded from 7.8G to 16G (~7.8G free), so the disk
  blocker is gone.
- Re-published v0.2.0 (4 artifacts) and v0.2.9 (5 artifacts) from the local build/
  outputs; both releases verify.
- Root SSH from the workstation is not available (publickey denied, password auth
  closes the banner); the host is administered via the zwitschi login.
- Version 0.2.12 exists to verify the tag pipeline end to end: the workflow should
  create the release via the checkout-credential fallback and upload all five
  artifacts.

MEMORY.md

@@ -149,7 +149,13 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   which carries the runner's basic-auth credentials for the same server. Verified locally by
   adding that extraheader and publishing v0.2.10 (all five artifacts). **v0.2.9 and v0.2.10
   are published**; v0.2.4–v0.2.8 tags have no artifacts. Verify the CI path on the next tag.
-- **Host disk full (2026-10-31):** the v0.2.11 tag build created release id 27 and logged the
+- **Host disk resolved (2026-10-31):** the Gitea VM root filesystem was expanded from 7.8G to
+  16G (`/dev/mapper/pve-vm--500--disk--0`, now ~7.8G free). The pruned **v0.2.0** and **v0.2.9**
+  releases were restored from the local `build/` artifacts and verified (4 and 5 assets).
+  `git.allucanget.biz` runs on this host as user `zwitschi`; root@192.168.88.30 is **not**
+  reachable from this workstation (publickey denied; password auth closes the banner), so host
+  maintenance must go through a `zwitschi` login with sudo.
+- **Host disk full (2026-10-31, historical):** the v0.2.11 tag build created release id 27 and logged the
   uploads, but they failed with `HTTP 500 Attachments.Save: write … no space left on device`
   (`/dev/mapper/pve-vm--500--disk--0`, 7.8G, 100%, 0 free). `git push` then failed too
   ("unpacker error"). Unblocked by deleting the superseded **v0.2.0** and **v0.2.9** releases

README.md

@@ -28,8 +28,8 @@ The central design goal is simple:
 
 **All releases:** <https://git.allucanget.biz/zwitschi/security-game/releases>
 
-> **Latest: v0.2.11** — release pipeline fix: tag builds publish without a repo secret by reusing
+> **Latest: v0.2.12** — release pipeline verified end to end: tag builds create the release and
-> the runner's checkout credentials.
+> upload all five artifacts without any repo secret.
 > Releases are built automatically when a `vX.Y.Z` tag is pushed
 > (see [`docs/RELEASING.md`](docs/RELEASING.md)); manual builds use
 > `./tools/build_releases.sh`. Installer/AppImage packaging runs in the same pipeline

TODO.md

@@ -35,11 +35,8 @@ Verified via API+host credentials (2026-10-31):
       Gitea runner does not expose `github.token`).
 - [x] Uploads now fail loudly and the release is verified to carry every artifact
       (a silent HTTP 4xx used to leave an empty release with a green job).
-- [x] Unblocked by pruning the superseded v0.2.0 and v0.2.9 releases (~565 MB) and
+- [x] Host disk expanded to 16G (~7.8G free on `/`); v0.2.0 and v0.2.9 releases restored from
-      publishing v0.2.11 locally; all five artifacts are on the release.
+      the local artifacts and verified. No cleanup needed any more.
-- [ ] **Host disk is still tight** (`/` 7.8G, ~150 MB free). Before the next release, run
-      on 192.168.88.30 as root: `journalctl --vacuum-size=100M` (journal is 837 MB),
-      `apt-get clean` (91 MB), and clear `/var/lib/gitea/data/attachments/tmp`.
 - [ ] Verify the fallback on the next tag push produces a release automatically (the
       v0.2.11 tag build reached the publish step and created the release; only the
       upload failed on disk space).

project.godot

@@ -8,7 +8,7 @@ config_version=5
 
 config/name="Step Line"
 config/description="Workplace security simulation about observation, access verification, and proportionate escalation."
-config/version="0.2.11"
+config/version="0.2.12"
 run/main_scene="res://scenes/main.tscn"
 config/features=PackedStringArray("4.3", "GL Compatibility")