Enable anonymous downloads on the host and harden Strings.fmt

Host (applied with root@192.168.88.30)
- [service] REQUIRE_SIGNIN_VIEW = false in /etc/gitea/app.ini (backup written
  alongside), Gitea restarted. Verified anonymously: repo page 200, API 200, and a
  release asset downloads at full size (50.8 MB AppImage).

Localization safety (Open Polish)
- Strings.placeholder_count() counts conversions and ignores %% escapes.
- Strings.fmt() validates the count and fails safe (warns, returns the template)
  instead of raising an engine error when a key's placeholders drift.
- Strings.validate() lints the table for a trailing %, unsupported conversions, and
  mixed positional/sequential placeholders.
- Tests cover the counter, the fail-safe path, a clean table, and a formatting pass
  over every placeholder key with type-correct arguments.

Docs
- TODO: distribution, release-pipeline, and open-polish sections are complete and
  moved to DONE; the v0.2.4-v0.2.8 backfill is closed as superseded.
- README/MEMORY updated. Version 0.2.14.

TODO.md

@@ -1,42 +1,8 @@
 # TODO
 
-Godot 4.3 prototype. Release **v0.2.13** is tagged. Headless suite **149/149**, plus the session,
+Godot 4.3 prototype. Latest release **v0.2.14**. Headless suite **153/153**, plus the session,
 PLAN-verb, crowd, emergency, timeline, audio, scenario-content, and windowed focus/radial smokes.
-
-Host `REQUIRE_SIGNIN_VIEW` stays deferred.
-
-## Distribution follow-up (host config, deferred)
-
-Verified via API+host credentials (2026-10-31):
-
-- [x] Repo is **public** (`private:false`) and account has admin rights.
-- [x] Release `v0.2.1` now carries all five artifacts (portable binaries + NSIS installer +
-      AppImage).
-- [ ] **Remaining host setting**: instance-wide `[service] REQUIRE_SIGNIN_VIEW=true` makes
-      anonymous browsing/downloads redirect to login. Host admin: `REQUIRE_SIGNIN_VIEW = false`
-      under `[service]` in `app.ini`, restart Gitea. Alternative: mirror downloads.
-
-## Release pipeline follow-up
-
-- [x] Fix `tools/publish_release.sh`: the `~/.git-credentials` branch never set `AUTH`,
-      so every tag build since v0.2.2 failed to publish.
-- [x] Add a `github.token` fallback in `.gitea/workflows/build.yml` (the repo has no
-      `GITEA_TOKEN` secret).
-- [x] Fall back to the checkout's git extraheader when no token/credentials exist (the
-      Gitea runner does not expose `github.token`).
-- [x] Uploads now fail loudly and the release is verified to carry every artifact
-      (a silent HTTP 4xx used to leave an empty release with a green job).
-- [x] Host disk expanded to 16G; v0.2.0 and v0.2.9 releases restored from the local artifacts.
-- [x] Host maintenance via `root@192.168.88.30`: apt cache cleaned and journald capped
-      (`SystemMaxUse=300M` in `/etc/systemd/journald.conf.d/99-size.conf`); ~7.6G free.
-- [x] Verified end to end: tagging v0.2.12 produced a release with all five artifacts
-      (AppImage, Linux, macOS, NSIS installer, Windows) from CI, with no repo secret.
-- [ ] Optionally backfill releases for v0.2.4–v0.2.8 (their CI artifacts were not
-      retained; would need local rebuilds) or leave them superseded by the latest.
-
-## Open Polish
-
-- [ ] Keep `%` placeholders stable in `Strings.fmt` when adding keys (positional formatting).
+Anonymous downloads are enabled on the host.
 
 ## Screen design references (QA tooling)