Fix release publishing and add a CI token fallback

Tag builds since v0.2.2 built all artifacts but never published a release:
- tools/publish_release.sh only assembled AUTH in the GITEA_TOKEN branch; the
  ~/.git-credentials branch set CRED and then used an unbound ${AUTH[@]} under
  `set -u`, so every API call failed and the job ended "could not create or find
  release". It now sets AUTH=(-u "$CRED").
- The repo has no GITEA_TOKEN secret and the runner has no git credentials, so the
  workflow now falls back to the built-in workflow token:
  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}.

v0.2.9 was then built and published locally with all five artifacts (portable
Linux/Windows/macOS, NSIS installer, AppImage) and the release page verified via
the API. v0.2.4-v0.2.8 remain unpublished; they are superseded by the latest.

Docs
- docs/RELEASING.md records the incident and the local-publish fallback.
- TODO gains a release-pipeline follow-up (verify CI on the next tag).
- MEMORY notes the root cause, the missing secret, and which releases exist.
- Version 0.2.10.

MEMORY.md

@@ -36,7 +36,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   `hud.controls` / `hud.screen_first` updated.
 - Control pass (in tree, uncommitted, smoke-tested): cone focus via `src/game/npc_focus.gd`,
   accel/decel, gravity only airborne, `input_locked` freeze, Esc no longer on the guard.
-  `NpcAvatar` in group `npc`; neck/hair/eyes/shoes; torus head ring + `Label3D` name; `set_focus_visual`.
+  `NpcAvatar` in group `npc`; neck/hair/eyes/shoes; blue focus circle + `Label3D` name; `set_focus_visual`.
   `src/game/ui/action_radial.gd` doughnut (LMB/Space open, A/D/arrows, Space/click confirm, Esc/RMB
   cancel). Crosshair CanvasLayer. Emergency still `R` only. Number keys 1–6 when the wheel is closed.
 - Named input actions now exist and are used: `action_menu`, `confirm`, `cancel` (Esc + RMB),
@@ -59,7 +59,7 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   (`assets/textures/skyline.png`, regenerated RGBA with a transparent sky) and an
   `TRANSPARENCY_ALPHA_SCISSOR` unshaded material (`_skyline_mat`); steps + landing are a
   `StaticBody3D` with per-tread `BoxShape3D` colliders; marquee `font_size` 160 / outline 24; focus
-  torus 0.26–0.34 + name tag 48px; `NpcAvatar.ephemeral`/`lifetime_s` despawns routine traffic
+  circle (blue disc in front of the face) + name tag 48px; `NpcAvatar.ephemeral`/`lifetime_s` despawns routine traffic
   (authored events stay). Guard spawn height verified on the landing (guard_y=0.84).
 - **PLAN verbs (2026-10-31, uncommitted):** the radial now has 12 slices
   (`Stop, Look, Point, No, Ask, Inspect, Wand, Warn, Block, Reason, Recognize, Radio`).
@@ -135,7 +135,16 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   needs `mipmaps/generate=true`.
 - **Asset gotcha:** `assets/textures/game_ready/` is *not* imported (no `.import`). Use the
   imported `assets/textures/skyline.png` path. Untracked duplicate folder should not be referenced.
-- Host sign-in follow-up remains deferred. PLAN.md + ADRs 0007–0010 still describe the intended UX.
+- Host sign-in follow-up remains deferred.
+- **Release publishing was broken since v0.2.2 (fixed 2026-10-31):** `publish_release.sh`
+  only built `AUTH` in the `GITEA_TOKEN` branch; the `~/.git-credentials` branch set `CRED`
+  and then used unbound `${AUTH[@]}` under `set -u`, so every API call failed and the tag
+  job ended "could not create or find release". The repo also has **no** `GITEA_TOKEN`
+  secret (`/actions/secrets` is empty) and the runner has no git credentials. Fixes: the
+  script sets `AUTH=(-u "$CRED")`; the workflow falls back to `github.token`
+  (`secrets.GITEA_TOKEN || github.token`). **v0.2.9 is the only release after v0.2.1**
+  (built and published locally, all five artifacts); v0.2.4–v0.2.8 tags have no release
+  artifacts. Verify the CI fallback on the next tag push. PLAN.md + ADRs 0007–0010 still describe the intended UX.
 - **Release v0.2.1 is LIVE** (2026-10-31): CI run 1110 built the NSIS installer + AppImage
   and published — installers/AppImage are on the releases page. Releasing = bump version → tag → push.
 - NSIS gotchas (validated in a local ubuntu:24.04 docker repro): makensis uses `-D` defines