Take the Gitea registry out of CI and mirror it separately

The Gitea registry is on a VPN, which a GitHub runner can never reach, so
the mirror step in the release workflow could only ever fail: its last four
releases reported a step that did nothing. The workflow now builds and
pushes to GHCR alone, which is the registry the installer defaults to, and
nothing in CI mentions Gitea.

The image reaches the Gitea registry through `scripts/mirror-gitea.sh`
(`bun run mirror:gitea`) instead, run in parallel with a release and from the
VPN side: it copies from the Gitea host over ssh, where skopeo can see both
registries, so nothing has to be installed there. `skopeo copy --all` keeps
the manifest list and its signatures, and every destination tag is read back
and compared with GHCR's digest, so a partial copy fails loudly instead of
being assumed to have worked. `latest` and `major.minor` are only moved while
that release still owns them in GHCR, so mirroring an older release never
rolls them back.

Neither direction can fail the other now, which is the point: a registry that
is down, slow or full no longer takes a release with it.

scripts/publish-github.sh

@@ -7,11 +7,12 @@
 # installer syntax), tags HEAD with the package.json version, pushes main and
 # the tag to the `origin` remote, then creates the GitHub release. Publishing
 # that release is what fires .github/workflows/release.yml, which builds the
-# multi-arch image and pushes it to GHCR (and mirrors it to Gitea).
+# multi-arch image and pushes it to GHCR, the registry the installer defaults
+# to. It never pushes to Gitea: that registry is on the VPN, out of a
+# runner's reach, so scripts/mirror-gitea.sh copies the image separately.
 #
 # Run scripts/publish-gitea.sh afterwards for the source mirror's own release
-# object. There is no existing publish script in the repo: this and its Gitea
-# twin are it.
+# object, and scripts/mirror-gitea.sh once the image build has finished.
 set -Eeuo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"