Fix release publishing and add a CI token fallback

Tag builds since v0.2.2 built all artifacts but never published a release:
- tools/publish_release.sh only assembled AUTH in the GITEA_TOKEN branch; the
  ~/.git-credentials branch set CRED and then used an unbound ${AUTH[@]} under
  `set -u`, so every API call failed and the job ended "could not create or find
  release". It now sets AUTH=(-u "$CRED").
- The repo has no GITEA_TOKEN secret and the runner has no git credentials, so the
  workflow now falls back to the built-in workflow token:
  GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}.

v0.2.9 was then built and published locally with all five artifacts (portable
Linux/Windows/macOS, NSIS installer, AppImage) and the release page verified via
the API. v0.2.4-v0.2.8 remain unpublished; they are superseded by the latest.

Docs
- docs/RELEASING.md records the incident and the local-publish fallback.
- TODO gains a release-pipeline follow-up (verify CI on the next tag).
- MEMORY notes the root cause, the missing secret, and which releases exist.
- Version 0.2.10.

src/test/smoke_focus_radial.gd

@@ -1,5 +1,5 @@
 extends SceneTree
-## Windowed smoke helper for the ADR-0007–0010 control pass (focus ring + action
+## Windowed smoke helper for the ADR-0007–0010 control pass (focus circle + action
 ## wheel). Boots the real main scene, stages one NPC in front of the guard, opens
 ## the wheel, and saves two PNGs to user://screenshots/. Exits 1 if the focus or
 ## radial state did not come up, so it can be used as a smoke check.
@@ -76,7 +76,7 @@ func _advance() -> void:
 						(gm.guard.global_position as Vector3).y,
 						(gm.targeted_npc.global_position as Vector3).y,
 					])
-					_shoot("smoke-01-focus-ring.png")
+					_shoot("smoke-01-focus-circle.png")
 					gm.call("_open_radial")
 				state = 2
 				state_frames = 0
@@ -127,7 +127,7 @@ func _fail(message: String) -> void:
 
 func _finish() -> void:
 	if failures.is_empty():
-		print("SMOKE OK: focus ring + action wheel opened and cancelled")
+		print("SMOKE OK: focus circle + action wheel opened and cancelled")
 		quit(0)
 	else:
 		for message in failures: