Prepare first downloadable release: install export templates, build 0.1.0 binaries, add publish helper

- Install Godot 4.3 export templates locally and fix macOS export
  (enable rendering/textures/vram_compression/import_etc2_astc)
- Build Linux/Windows/macOS artifacts into build/ via tools/build_releases.sh;
  Linux binary passes headless smoke test
- Add tools/publish_release.sh (creates Gitea release + uploads assets with a token)
- TODO: mark build/install steps done; publishing v0.1.0 + link verification
  remain as the single action blocker (needs GITEA_TOKEN)

MEMORY.md

@@ -26,7 +26,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Run tests: `godot --headless --path . --script res://src/test/test_runner.gd`
 - Boot check: `godot --headless --path . --quit-after 120`
 - Screenshot tool: `godot --path . --script res://src/test/take_screenshot.gd` (writes to `user://screenshot.png`).
-- Release build: `./tools/build_releases.sh` requires export templates (see `docs/RELEASING.md`).
+- Release build verified locally: export templates for 4.3 installed at `~/.local/share/godot/export_templates/4.3.stable/`; `./tools/build_releases.sh` produced Linux/Windows/macOS artifacts for 0.1.0 in `build/` and the Linux binary passed a headless smoke test. Publishing to Gitea still needs a token (see `tools/publish_release.sh`, `docs/RELEASING.md`).
 
 ## Known Issues / Notes
 
@@ -34,7 +34,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Headless (dummy renderer) logs "Parameter m is null" from `mesh_get_surface_count`; it does not occur with a real GL driver and does not affect logic.
 - Steps are visual-only (no collider) so NPCs can path to the entrance; the guard spawns on the landing so it never needs to climb.
 - Persistence tests write into the real `user://shift_results.json` (harmless local pollution of the demo history).
-- Export presets and release scripts are **not yet verified with real export templates** (none installed on this machine); see `docs/RELEASING.md` before first release.
+- macOS export required `rendering/textures/vram_compression/import_etc2_astc=true` in `project.godot` (universal build demands ETC2 ASTC enabled).
 - Joke Shop `door_staff_lines` authored but not yet surfaced in the prototype UI (tracked in TODO).
 
 ## Open Questions

TODO.md

@@ -1,11 +1,26 @@
 # TODO
 
+## 🔴 PRIORITY — Ship downloadable builds (so the README Downloads links work)
+
+Goal: users hitting the README **Downloads** section can actually download a playable version from
+`https://git.allucanget.biz/zwitschi/security-game/releases`.
+
+- [x] Install Godot 4.3 export templates locally (see `docs/RELEASING.md` step 1).
+- [x] Run `./tools/build_releases.sh` and confirm the three artifacts appear in `build/`.
+- [x] Smoke-test the Linux binary launches (`./build/step-line-linux-0.1.0.x86_64 --headless --quit-after 120` → 0 script errors).
+- [ ] Create a Gitea release `v0.1.0` (tag matching `config/version` in `project.godot`) — **needs `GITEA_TOKEN`**: `GITEA_TOKEN=... ./tools/publish_release.sh 0.1.0`.
+- [ ] Verify the README Downloads links resolve: visit the release page and download one artifact.
+- [x] (Local workflow) `tools/publish_release.sh` exists so future releases need only a `GITEA_TOKEN`.
+
+### Follow-ups once the first release is live
+
+- [ ] CI packaging: build and upload artifacts automatically on tags.
+
 ## Future Systems (design-level backlog)
 
 - [ ] Body-camera replay timeline in the shift review.
 - [ ] Long (10-15 minute) shift lengths and phase-based lighting (darkened evening / late phases).
 - [ ] Venue selection screen (wire `switch_scenario` to a startup menu).
-- [ ] CI packaging: upload `build/` artifacts to releases automatically on tags.
 - [ ] IDE/editor-based GUT integration when a Godot editor workflow is introduced.
 - [ ] Reduce RefCounted reference cycles (NPCController <-> FSM) noted in `MEMORY.md`.
 

docs/RELEASING.md

@@ -54,6 +54,18 @@ Artifacts are written to `build/`:
 
 The repository lives at `https://git.allucanget.biz/zwitschi/security-game`.
 
+Preferred path — use the helper script with a token:
+
+```bash
+GITEA_TOKEN=your_api_token ./tools/publish_release.sh 0.1.0
+```
+
+The script creates the release from `project.godot`'s `config/version`, uploads
+all three `build/` artifacts, and prints the release URL. The token needs only
+`write:repository` scope on the Gitea host.
+
+Manual alternative:
+
 ### Via the web UI
 
 1. Create a **New Release** with tag `v<version>`.

export_presets.cfg

@@ -92,7 +92,7 @@ custom_template/release=""
 debug/export_console_wrapper=0
 binary_format/embed_pck=false
 texture_format/s3tc_bptc=true
-texture_format/etc2_astc=false
+texture_format/etc2_astc=true
 codesign/enable=false
 codesign/timestamp=true
 codesign/identity_type=0

project.godot

@@ -105,3 +105,4 @@ print_debug={
 
 renderer/rendering_method="gl_compatibility"
 renderer/rendering_method.mobile="gl_compatibility"
+textures/vram_compression/import_etc2_astc=true

tools/publish_release.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Publish a release to the Gitea/Forgejo host, uploading the built artifacts.
+#
+# Requires:
+#   - GITEA_TOKEN (a token with write access to the repo)
+#   - build artifacts from tools/build_releases.sh (or already exported)
+#
+# Usage:
+#   GITEA_TOKEN=xxx ./tools/publish_release.sh [version]
+#   (version defaults to config/version from project.godot)
+set -euo pipefail
+
+REPO="${REPO:-zwitschi/security-game}"
+HOST="${HOST:-https://git.allucanget.biz}"
+API="$HOST/api/v1/repos/$REPO/releases"
+VERSION="${1:-$(grep -oP 'config/version="\K[^"]+' project.godot)}"
+TAG="v$VERSION"
+
+if [[ -z "${GITEA_TOKEN:-}" ]]; then
+  echo "error: GITEA_TOKEN is not set (see docs/RELEASING.md)" >&2
+  exit 1
+fi
+
+# Artifacts must already exist (run tools/build_releases.sh first).
+printf -v BS 'build/step-line-linux-%s.x86_64' "$VERSION"
+printf -v BS_WIN 'build/step-line-windows-%s.exe' "$VERSION"
+printf -v BS_MAC 'build/step-line-macos-%s.zip' "$VERSION"
+for f in "$BS" "$BS_WIN" "$BS_MAC"; do
+  if [[ ! -f "$f" ]]; then
+    echo "error: missing artifact $f — run ./tools/build_releases.sh first" >&2
+    exit 1
+  fi
+done
+
+echo "==> Creating release $TAG on $HOST/$REPO"
+RELEASE_JSON="$(curl -s -X POST "$API" \
+  -H "Authorization: token $GITEA_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"Step Line $VERSION — playable prototype. See README for controls.\",\"draft\":false,\"prerelease\":false}")"
+
+RELEASE_ID="$(echo "$RELEASE_JSON" | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)"
+if [[ -z "$RELEASE_ID" ]]; then
+  echo "error: could not create release; response:" >&2
+  echo "$RELEASE_JSON" >&2
+  exit 1
+fi
+echo "Release id: $RELEASE_ID"
+
+for f in "$BS" "$BS_WIN" "$BS_MAC"; do
+  echo "==> Uploading $(basename "$f")"
+  curl -s -X POST "$API/$RELEASE_ID/assets" \
+    -H "Authorization: token $GITEA_TOKEN" \
+    -F "attachment=@$f" >/dev/null
+done
+
+echo ""
+echo "Release live: $HOST/$REPO/releases/tag/$TAG"