Publish releases from two scripts, one per remote

A release meant running the RELEASING.md checklist by hand: tag, push
twice, create the GitHub release, then remember the Gitea push. The two
scripts do the machine-checkable part of it, with the shared flow in
scripts/lib/ so they cannot drift apart: clean worktree, not behind the
remote, typecheck, tests and the install.sh syntax check, then the tag at
HEAD, the branch push and the release object.

Only the release object differs. GitHub creates it with gh, and publishing
it is what fires the image build. Gitea gets the same notes through its
API, with the token from GITEA_TOKEN or the one tea already stored, since
nothing there builds images.

Both accept --version (defaulting to package.json), --branch, --yes,
--dry-run and --skip-checks, and a rerun finishes a release that failed
half way instead of starting over: an existing tag is reused, a pushed ref
is skipped and an existing release is left alone. A tag sitting on another
commit is refused, since publishing would ship that commit's code.

package.json

@@ -16,7 +16,9 @@
         "start": "MAIN_SERVER=1 NODE_ENV=production bun src/server.ts",
         "typecheck": "tsc --noEmit",
         "test": "bun test",
-        "check:bundle": "bun src/scripts/check-bundle-size.ts"
+        "check:bundle": "bun src/scripts/check-bundle-size.ts",
+        "publish:github": "bash scripts/publish-github.sh",
+        "publish:gitea": "bash scripts/publish-gitea.sh"
     },
     "devDependencies": {
         "@next/mdx": "^16.3.0",