Publish releases with the runner's checkout credentials

The v0.2.10 tag build still failed to publish: its env dump showed no token at all,
because this Gitea/act runner does not provide `github.token`, and the repo has no
GITEA_TOKEN secret.

publish_release.sh now resolves credentials in order: GITEA_TOKEN,
GITEA_AUTH_HEADER, ~/.git-credentials, then the local git extraheader that
actions/checkout writes for the job. That header carries the runner's basic-auth
credentials for the same server, so tag builds publish with no repo secret.

Verified by adding the extraheader locally and publishing v0.2.10 (all five
artifacts: Linux/Windows/macOS ports, NSIS installer, AppImage), then removing it.

Docs: RELEASING describes the four credential sources and warns that github.token is
not available here; MEMORY records both failed attempts and the final fix; TODO keeps
the "verify on the next tag" follow-up. Version 0.2.11.

.gitea/workflows/build.yml

@@ -113,11 +113,10 @@ jobs:
       - name: Publish Gitea release (tags only)
         if: startsWith(github.ref, 'refs/tags/')
         env:
-          # Prefer an explicit repo secret; otherwise fall back to the workflow's
-          # built-in token (Gitea provides `github.token`), which has write access
-          # to this repository. Without either, publish_release.sh has no
-          # credentials inside the runner and the step fails.
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
+          # An explicit repo secret wins. Without one, publish_release.sh reuses
+          # the local git extraheader that actions/checkout configures for the job
+          # (the runner's own credentials), so tag builds still publish.
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           VERSION: ${{ github.ref_name }}
         run: |
           chmod +x tools/publish_release.sh