Take the Gitea registry out of CI and mirror it separately

The Gitea registry is on a VPN, which a GitHub runner can never reach, so
the mirror step in the release workflow could only ever fail: its last four
releases reported a step that did nothing. The workflow now builds and
pushes to GHCR alone, which is the registry the installer defaults to, and
nothing in CI mentions Gitea.

The image reaches the Gitea registry through `scripts/mirror-gitea.sh`
(`bun run mirror:gitea`) instead, run in parallel with a release and from the
VPN side: it copies from the Gitea host over ssh, where skopeo can see both
registries, so nothing has to be installed there. `skopeo copy --all` keeps
the manifest list and its signatures, and every destination tag is read back
and compared with GHCR's digest, so a partial copy fails loudly instead of
being assumed to have worked. `latest` and `major.minor` are only moved while
that release still owns them in GHCR, so mirroring an older release never
rolls them back.

Neither direction can fail the other now, which is the point: a registry that
is down, slow or full no longer takes a release with it.

RELEASING.md

@@ -62,16 +62,24 @@ them in that order, since only the GitHub release builds images.
        gh release create v0.1.0 --title v0.1.0 --notes-file notes.md --latest
 
 7. [ ] The release workflow builds `linux/amd64` and `linux/arm64` and
-       pushes to both registries:
-       - `ghcr.io/moduletrace/cobble`
-       - `git.tben.me/moduletrace/cobble`
+       pushes to `ghcr.io/moduletrace/cobble`, the registry the installer
+       defaults to. It does not touch Gitea: that registry is on the VPN,
+       and a GitHub runner cannot reach it.
 8. [ ] Check the manifests:
 
        docker buildx imagetools inspect ghcr.io/moduletrace/cobble:latest
-       docker buildx imagetools inspect git.tben.me/moduletrace/cobble:latest
 
 9. [ ] Confirm the GHCR package is public and pull it anonymously.
-10. [ ] Publish the release to Gitea as well:
+10. [ ] Once the build has finished, copy the image into the Gitea registry
+        from the VPN:
+
+        GITEA_TOKEN=... bun run mirror:gitea   # or: scripts/mirror-gitea.sh
+
+        It copies the version and commit tags, plus `latest` and
+        `major.minor` while this release still owns them, and reads every
+        destination digest back. A failure here does not affect the release:
+        the installer keeps working from GHCR.
+11. [ ] Publish the release to Gitea as well:
 
         scripts/publish-gitea.sh                  # or: bun run publish:gitea
 
@@ -79,7 +87,7 @@ them in that order, since only the GitHub release builds images.
         git push gitea main
         git push gitea refs/tags/v0.1.0
 
-11. [ ] Update every install with the one-liner:
+12. [ ] Update every install with the one-liner:
 
         curl -fsSL https://url.moduletrace.com/cobble | sudo bash