Fix release publishing and add a CI token fallback

Tag builds since v0.2.2 built all artifacts but never published a release:
- tools/publish_release.sh only assembled AUTH in the GITEA_TOKEN branch; the
  ~/.git-credentials branch set CRED and then used an unbound ${AUTH[@]} under
  `set -u`, so every API call failed and the job ended "could not create or find
  release". It now sets AUTH=(-u "$CRED").
- The repo has no GITEA_TOKEN secret and the runner has no git credentials, so the
  workflow now falls back to the built-in workflow token:
  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}.

v0.2.9 was then built and published locally with all five artifacts (portable
Linux/Windows/macOS, NSIS installer, AppImage) and the release page verified via
the API. v0.2.4-v0.2.8 remain unpublished; they are superseded by the latest.

Docs
- docs/RELEASING.md records the incident and the local-publish fallback.
- TODO gains a release-pipeline follow-up (verify CI on the next tag).
- MEMORY notes the root cause, the missing secret, and which releases exist.
- Version 0.2.10.

docs/adr/0008-cone-focus-and-head-ring.md

@@ -1,4 +1,4 @@
-# ADR-0008: Cone focus and head ring
+# ADR-0008: Cone focus and focus circle
 
 - **Status:** Accepted
 - **Date:** TBD
@@ -19,7 +19,7 @@ Focus is a **cone**, not a ray.
 - A few frames of grace keep walk-bob from dropping focus.
 - `Tab` still cycles people inside 12 m and sets the same focused person.
 
-When someone is in focus, draw a **thin ring** around their head, attached to the avatar `Head` node, billboarded so it stays a circle on screen. Pale gold while idle; brighter and slightly larger while the action menu is open on that person. Optional `display_name` under the ring. One ring at a time.
+When someone is in focus, draw a **blue, semi-transparent circle in front of the face**, attached to the avatar `Head` node, billboarded so it stays a circle on screen. Blue while idle; brighter and slightly larger while the action menu is open on that person. Optional `display_name` under the circle. One circle at a time.
 
 The world must not show the internal type name (`Trespasser`, `Violent Threat`). The debug overlay (`F`) can still print it.
 
@@ -28,19 +28,19 @@ The world must not show the internal type name (`Trespasser`, `Violent Threat`).
 ### Positive
 
 - Looking near a person is enough; the player does not have to pin a capsule.
-- The ring is visible in the scene, so the HUD is not the only focus cue.
+- The circle is visible in the scene, so the HUD is not the only focus cue.
 - `Tab` remains the accessibility path and shares the same focused person.
 - The action menu (ADR-0009) has a clear subject.
 
 ### Negative
 
 - Two heads in the same circle can steal focus; center-distance is a heuristic, not a lock-on.
-- Hats and protester signs can z-fight a 3D torus. A screen-space circle unprojected from the head is an allowed fallback.
+- Hats and protester signs can z-fight a 3D circle. A screen-space circle unprojected from the head is an allowed fallback.
 - Occlusion rays can fail on unusual geometry; grace frames hide some of that.
 
 ## Alternatives considered
 
 - **Keep the hairline ray:** Rejected because it drops people too easily and has no world mark.
 - **Sticky lock-on until cancelled:** Rejected because the job is to watch a crowd, not duel one person.
-- **Screen reticle only, no world ring:** Rejected; in a crowd the player needs a mark on the head, not only a HUD line.
+- **Screen reticle only, no world circle:** Rejected; in a crowd the player needs a mark on the face, not only a HUD line.
 - **Click a person to select, then act:** Rejected for default play. The mouse is captured for look (ADR-0007). Click opens the action menu on whoever is already in the cone.