Publish from CI without a secret

Woodpecker hands every step a forge credential for cloning — an access token of the
repository's owner — and a one-off diagnostic in the check step confirmed it is there.
scripts/ci-upload.sh now uses it when no `gitea_token` secret is set, so publishing a
release needs nothing configured. Gitea takes such a credential as `token …` or
`Bearer …` depending on how Woodpecker was set up, so the script probes which of the two
`/user` accepts rather than assuming, and says which one it used.

The secret mapping is gone from the step as well: referencing a secret that does not
exist is a failure mode of its own, and the fallback is the normal path now. Adding a
`gitea_token` secret and mapping it back in is how you publish as somebody else.

Documents the release flow the pipeline now implements: push a vX.Y.Z tag, the pipeline
builds Linux and Windows and creates the release with them in it, and `make release` from
a Mac pushes the macOS package onto the same release. Either half can go first.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.woodpecker.yaml

@@ -23,9 +23,6 @@ steps:
     image: *node_image
     commands:
       - node --version
-      # One-off diagnostic: does Woodpecker hand steps a forge credential of their own?
-      # If it does, the release step needs no secret at all.
-      - 'echo "netrc user: ${CI_NETRC_USERNAME:+present}, password: ${CI_NETRC_PASSWORD:+present}"'
       - npm ci
       - npm run typecheck
       - npm run lint
@@ -61,9 +58,9 @@ steps:
   # from the Mac that can sign them.
   - name: release
     image: alpine
-    environment:
-      GITEA_TOKEN:
-        from_secret: gitea_token
+    # No secret: the step authenticates with the forge credential Woodpecker already
+    # hands every step, which belongs to the repository's owner. To publish as someone
+    # else instead, add a `gitea_token` repository secret and map it here as GITEA_TOKEN.
     commands:
       - apk add --no-cache curl jq
       # No globs on the command line: the package names have spaces in them.