Complete PRIORITY: release v0.2.0 published by CI; document download sign-in caveat

- Tag v0.2.0 pushed; Gitea Actions build job exported Linux/Windows/macOS
  and published the release via the host's GITEA_TOKEN secret (CI run 1095:
  'Release live: .../releases/tag/v0.2.0', Job succeeded)
- Verified tag page + /releases are public (HTTP 200); anonymous asset
  downloads require sign-in on the host (tracked as host-config follow-up)
- TODO cleaned per AGENTS.md; PRIORITY section moved to DONE.md
- README Downloads notes v0.2.0 live + sign-in caveat; MEMORY updated

TODO.md

@@ -1,18 +1,10 @@
 # TODO
 
-## 🔴 PRIORITY — Ship downloadable builds (so the README Downloads links work)
+## Distribution follow-up (host config, no code work)
 
-Goal: users hitting the README **Downloads** section can download a playable version from
-`https://git.allucanget.biz/zwitschi/security-game/releases`.
-
-- [x] Install Godot 4.3 export templates locally.
-- [x] `./tools/build_releases.sh` produces Linux/Windows/macOS artifacts (built for 0.2.0).
-- [x] Linux binary smoke-tested (headless, 0 script errors).
-- [ ] Publish the release — **blocked on `GITEA_TOKEN`**: once the token is available run
-      `GITEA_TOKEN=... ./tools/publish_release.sh 0.2.0`, or (if the repo secret is already set
-      on the host) push the `v0.2.0` tag and let CI publish via `.gitea/workflows/build.yml`.
-- [ ] Confirm the README Downloads links resolve: check
-      `https://git.allucanget.biz/zwitschi/security-game/releases` and download one artifact.
+- [ ] Asset downloads currently require sign-in on the host (`/releases/download/…` redirects to
+      login). Decide with the host admin: open repo visibility / `REQUIRE_SIGNIN_VIEW=false` or
+      accept sign-in-required downloads. Pages and the tag page are already public (HTTP 200).
 
 ## Future Systems (design-level backlog)