Record verified CI publishing and host maintenance

- v0.2.12 was tagged and CI produced the release with all five artifacts by itself,
  confirming the checkout-credential fallback end to end.
- Host maintenance through root@192.168.88.30: apt cache cleaned and journald capped
  at 300M (journal ~133M now), ~7.6G free of 16G.
- TODO release-pipeline section is fully closed; MEMORY records the host state.

MEMORY.md

@@ -149,6 +149,12 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   which carries the runner's basic-auth credentials for the same server. Verified locally by
   adding that extraheader and publishing v0.2.10 (all five artifacts). **v0.2.9 and v0.2.10
   are published**; v0.2.4–v0.2.8 tags have no artifacts. Verify the CI path on the next tag.
+- **CI publishing verified (2026-10-31):** tagging v0.2.12 produced a release with all five
+  artifacts automatically (no repo secret), confirming the checkout-extraheader fallback.
+- **Host access (2026-10-31):** `root@192.168.88.30` now works from this workstation (key auth),
+  host name `gitea`, Gitea 28.2.0. Maintenance applied: `apt-get clean`, journald capped to
+  `SystemMaxUse=300M` (`/etc/systemd/journald.conf.d/99-size.conf`, journal ~133M), disk at
+  ~7.6G free of 16G.
 - **Host disk resolved (2026-10-31):** the Gitea VM root filesystem was expanded from 7.8G to
   16G (`/dev/mapper/pve-vm--500--disk--0`, now ~7.8G free). The pruned **v0.2.0** and **v0.2.9**
   releases were restored from the local `build/` artifacts and verified (4 and 5 assets).

TODO.md

@@ -35,11 +35,11 @@ Verified via API+host credentials (2026-10-31):
       Gitea runner does not expose `github.token`).
 - [x] Uploads now fail loudly and the release is verified to carry every artifact
       (a silent HTTP 4xx used to leave an empty release with a green job).
-- [x] Host disk expanded to 16G (~7.8G free on `/`); v0.2.0 and v0.2.9 releases restored from
-      the local artifacts and verified. No cleanup needed any more.
-- [ ] Verify the fallback on the next tag push produces a release automatically (the
-      v0.2.11 tag build reached the publish step and created the release; only the
-      upload failed on disk space).
+- [x] Host disk expanded to 16G; v0.2.0 and v0.2.9 releases restored from the local artifacts.
+- [x] Host maintenance via `root@192.168.88.30`: apt cache cleaned and journald capped
+      (`SystemMaxUse=300M` in `/etc/systemd/journald.conf.d/99-size.conf`); ~7.6G free.
+- [x] Verified end to end: tagging v0.2.12 produced a release with all five artifacts
+      (AppImage, Linux, macOS, NSIS installer, Windows) from CI, with no repo secret.
 - [ ] Optionally backfill releases for v0.2.4–v0.2.8 (their CI artifacts were not
       retained; would need local rebuilds) or leave them superseded by the latest.