Publish releases with the runner's checkout credentials

The v0.2.10 tag build still failed to publish: its env dump showed no token at all,
because this Gitea/act runner does not provide `github.token`, and the repo has no
GITEA_TOKEN secret.

publish_release.sh now resolves credentials in order: GITEA_TOKEN,
GITEA_AUTH_HEADER, ~/.git-credentials, then the local git extraheader that
actions/checkout writes for the job. That header carries the runner's basic-auth
credentials for the same server, so tag builds publish with no repo secret.

Verified by adding the extraheader locally and publishing v0.2.10 (all five
artifacts: Linux/Windows/macOS ports, NSIS installer, AppImage), then removing it.

Docs: RELEASING describes the four credential sources and warns that github.token is
not available here; MEMORY records both failed attempts and the final fix; TODO keeps
the "verify on the next tag" follow-up. Version 0.2.11.

tools/publish_release.sh

@@ -16,8 +16,17 @@ HOST="${HOST:-https://git.allucanget.biz}"
 VERSION="${1:-$(grep -oP 'config/version="\K[^"]+' project.godot)}"
 TAG="v$VERSION"
 
+# AUTH is a curl argument list. Populated by the first available method:
+#   1. GITEA_TOKEN            explicit token (repo secret in CI)
+#   2. GITEA_AUTH_HEADER      a ready-made "Authorization: ..." header
+#   3. ~/.git-credentials     basic auth for HOST
+#   4. the checkout's git extraheader (Gitea Actions runners inject one for the
+#      job; this is what makes tag builds publish without any repo secret)
+AUTH=()
 if [[ -n "${GITEA_TOKEN:-}" ]]; then
-  AUTH=("Authorization: token $GITEA_TOKEN")
+  AUTH=(-H "Authorization: token $GITEA_TOKEN")
+elif [[ -n "${GITEA_AUTH_HEADER:-}" ]]; then
+  AUTH=(-H "$GITEA_AUTH_HEADER")
 elif [[ -f "$HOME/.git-credentials" ]]; then
   CRED="$(python3 -c "
 import os
@@ -31,8 +40,20 @@ for l in open(os.path.expanduser('~/.git-credentials')):
   # curl basic auth. (Previously only CRED was set, so ${AUTH[@]} was unbound
   # under `set -u` and every API call failed silently.)
   AUTH=(-u "$CRED")
-else
-  echo "error: set GITEA_TOKEN or provide ~/.git-credentials" >&2
+fi
+
+if [[ ${#AUTH[@]} -eq 0 ]]; then
+  # Gitea Actions: actions/checkout configures a local extraheader with the
+  # runner's credentials. Reuse it for the API (the same server, so the header is
+  # valid for $HOST too).
+  GIT_HEADER="$(git config --local --get-regexp '^http\..*\.extraheader$' 2>/dev/null | head -n1 | cut -d' ' -f2- || true)"
+  if [[ -n "${GIT_HEADER:-}" ]]; then
+    AUTH=(-H "$GIT_HEADER")
+  fi
+fi
+
+if [[ ${#AUTH[@]} -eq 0 ]]; then
+  echo "error: no credentials. Set GITEA_TOKEN, GITEA_AUTH_HEADER, or provide ~/.git-credentials." >&2
   exit 1
 fi