Prepare first downloadable release: install export templates, build 0.1.0 binaries, add publish helper

- Install Godot 4.3 export templates locally and fix macOS export
  (enable rendering/textures/vram_compression/import_etc2_astc)
- Build Linux/Windows/macOS artifacts into build/ via tools/build_releases.sh;
  Linux binary passes headless smoke test
- Add tools/publish_release.sh (creates Gitea release + uploads assets with a token)
- TODO: mark build/install steps done; publishing v0.1.0 + link verification
  remain as the single action blocker (needs GITEA_TOKEN)

tools/publish_release.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Publish a release to the Gitea/Forgejo host, uploading the built artifacts.
+#
+# Requires:
+#   - GITEA_TOKEN (a token with write access to the repo)
+#   - build artifacts from tools/build_releases.sh (or already exported)
+#
+# Usage:
+#   GITEA_TOKEN=xxx ./tools/publish_release.sh [version]
+#   (version defaults to config/version from project.godot)
+set -euo pipefail
+
+REPO="${REPO:-zwitschi/security-game}"
+HOST="${HOST:-https://git.allucanget.biz}"
+API="$HOST/api/v1/repos/$REPO/releases"
+VERSION="${1:-$(grep -oP 'config/version="\K[^"]+' project.godot)}"
+TAG="v$VERSION"
+
+if [[ -z "${GITEA_TOKEN:-}" ]]; then
+  echo "error: GITEA_TOKEN is not set (see docs/RELEASING.md)" >&2
+  exit 1
+fi
+
+# Artifacts must already exist (run tools/build_releases.sh first).
+printf -v BS 'build/step-line-linux-%s.x86_64' "$VERSION"
+printf -v BS_WIN 'build/step-line-windows-%s.exe' "$VERSION"
+printf -v BS_MAC 'build/step-line-macos-%s.zip' "$VERSION"
+for f in "$BS" "$BS_WIN" "$BS_MAC"; do
+  if [[ ! -f "$f" ]]; then
+    echo "error: missing artifact $f — run ./tools/build_releases.sh first" >&2
+    exit 1
+  fi
+done
+
+echo "==> Creating release $TAG on $HOST/$REPO"
+RELEASE_JSON="$(curl -s -X POST "$API" \
+  -H "Authorization: token $GITEA_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\",\"body\":\"Step Line $VERSION — playable prototype. See README for controls.\",\"draft\":false,\"prerelease\":false}")"
+
+RELEASE_ID="$(echo "$RELEASE_JSON" | python3 -c "import sys,json;print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)"
+if [[ -z "$RELEASE_ID" ]]; then
+  echo "error: could not create release; response:" >&2
+  echo "$RELEASE_JSON" >&2
+  exit 1
+fi
+echo "Release id: $RELEASE_ID"
+
+for f in "$BS" "$BS_WIN" "$BS_MAC"; do
+  echo "==> Uploading $(basename "$f")"
+  curl -s -X POST "$API/$RELEASE_ID/assets" \
+    -H "Authorization: token $GITEA_TOKEN" \
+    -F "attachment=@$f" >/dev/null
+done
+
+echo ""
+echo "Release live: $HOST/$REPO/releases/tag/$TAG"