Record verified CI publishing and host maintenance

- v0.2.12 was tagged and CI produced the release with all five artifacts by itself,
  confirming the checkout-credential fallback end to end.
- Host maintenance through root@192.168.88.30: apt cache cleaned and journald capped
  at 300M (journal ~133M now), ~7.6G free of 16G.
- TODO release-pipeline section is fully closed; MEMORY records the host state.

TODO.md

@@ -35,11 +35,11 @@ Verified via API+host credentials (2026-10-31):
       Gitea runner does not expose `github.token`).
 - [x] Uploads now fail loudly and the release is verified to carry every artifact
       (a silent HTTP 4xx used to leave an empty release with a green job).
-- [x] Host disk expanded to 16G (~7.8G free on `/`); v0.2.0 and v0.2.9 releases restored from
-      the local artifacts and verified. No cleanup needed any more.
-- [ ] Verify the fallback on the next tag push produces a release automatically (the
-      v0.2.11 tag build reached the publish step and created the release; only the
-      upload failed on disk space).
+- [x] Host disk expanded to 16G; v0.2.0 and v0.2.9 releases restored from the local artifacts.
+- [x] Host maintenance via `root@192.168.88.30`: apt cache cleaned and journald capped
+      (`SystemMaxUse=300M` in `/etc/systemd/journald.conf.d/99-size.conf`); ~7.6G free.
+- [x] Verified end to end: tagging v0.2.12 produced a release with all five artifacts
+      (AppImage, Linux, macOS, NSIS installer, Windows) from CI, with no repo secret.
 - [ ] Optionally backfill releases for v0.2.4–v0.2.8 (their CI artifacts were not
       retained; would need local rebuilds) or leave them superseded by the latest.