The publishing step needs the secret after all

A manual build printed a forge credential, so the last change dropped the secret and
relied on it. The first tag build then built all four packages and died at the publishing
step with no credential at all: a build started by the tag webhook does not get one.

So `gitea_token` is a repository secret again, mapped into the step, with the forge
credential kept as a fallback for the manual case. The README and the wiki now describe
what was measured rather than what the manual build suggested.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.woodpecker.yaml

@@ -58,9 +58,13 @@ steps:
   # from the Mac that can sign them.
   - name: release
     image: alpine
-    # No secret: the step authenticates with the forge credential Woodpecker already
-    # hands every step, which belongs to the repository's owner. To publish as someone
-    # else instead, add a `gitea_token` repository secret and map it here as GITEA_TOKEN.
+    environment:
+      # Needed. Woodpecker does hand steps a forge credential — a manual build printed
+      # one — but a build started by the tag webhook does not get it: the first tag build
+      # died here with no credential at all. So the token is a repository secret, and the
+      # script still falls back to the forge credential when it is there.
+      GITEA_TOKEN:
+        from_secret: gitea_token
     commands:
       - apk add --no-cache curl jq
       # No globs on the command line: the package names have spaces in them.