Fix release publishing and add a CI token fallback

Tag builds since v0.2.2 built all artifacts but never published a release:
- tools/publish_release.sh only assembled AUTH in the GITEA_TOKEN branch; the
  ~/.git-credentials branch set CRED and then used an unbound ${AUTH[@]} under
  `set -u`, so every API call failed and the job ended "could not create or find
  release". It now sets AUTH=(-u "$CRED").
- The repo has no GITEA_TOKEN secret and the runner has no git credentials, so the
  workflow now falls back to the built-in workflow token:
  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}.

v0.2.9 was then built and published locally with all five artifacts (portable
Linux/Windows/macOS, NSIS installer, AppImage) and the release page verified via
the API. v0.2.4-v0.2.8 remain unpublished; they are superseded by the latest.

Docs
- docs/RELEASING.md records the incident and the local-publish fallback.
- TODO gains a release-pipeline follow-up (verify CI on the next tag).
- MEMORY notes the root cause, the missing secret, and which releases exist.
- Version 0.2.10.

.gitea/workflows/build.yml

@@ -113,7 +113,11 @@ jobs:
       - name: Publish Gitea release (tags only)
         if: startsWith(github.ref, 'refs/tags/')
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          # Prefer an explicit repo secret; otherwise fall back to the workflow's
+          # built-in token (Gitea provides `github.token`), which has write access
+          # to this repository. Without either, publish_release.sh has no
+          # credentials inside the runner and the step fails.
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
           VERSION: ${{ github.ref_name }}
         run: |
           chmod +x tools/publish_release.sh