ci: move the release-installer build from Gitea back to GitHub Actions

GitHub-hosted windows-latest/macos-latest replace the self-hosted act_runner
pair; node 24 + corepack pnpm are set up explicitly (hosted images do not
preinstall pnpm), and assets attach via gh release upload --clobber instead
of the Gitea-API uploader script. macOS signing falls back to ad-hoc until a
Developer ID cert + APPLE_API_ISSUER secret are provisioned on GitHub.

Claude-Session: https://claude.ai/code/session_01A6RcwHhhsFYYrNdQB4ASuP

.github/workflows/release-build.yml

@@ -0,0 +1,122 @@
+name: Build Release Installers
+
+# Builds the Windows and macOS installers whenever a release is published and
+# attaches them to that release. To back-fill installers onto an older
+# release, run this workflow manually with the release tag as input (note: a
+# manual run builds the dispatched ref's code, not the old tag's).
+#
+# Runs on GitHub-hosted runners (windows-latest / macos-latest). Node 24 comes
+# from actions/setup-node; pnpm is activated via corepack and pinned by the
+# `packageManager` field in package.json.
+#
+# macOS signing: hosted runners have no Developer ID certificate in the
+# keychain, so the signing-detection step falls back to ad-hoc-signed,
+# un-notarized installers with a warning. To ship signed + notarized builds
+# from hosted runners you would need to import the "Developer ID Application:
+# Yang Zhang (9PDD8M2SMS)" certificate (e.g. a base64 P12 secret + an import
+# step) and set the APPLE_API_ISSUER secret (App Store Connect issuer ID)
+# used together with the API key file in the repo.
+#
+# (2026-08: this pipeline ran as .gitea/workflows/release-build.yml against
+# self-hosted runners while the GitHub account was unavailable.)
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to attach installers to (back-fill)"
+        required: true
+
+permissions:
+  contents: write
+
+env:
+  COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+
+jobs:
+  windows:
+    name: Windows installer (NSIS x64)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - name: Enable pnpm via corepack
+        run: |
+          corepack enable pnpm
+          pnpm --version
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Build installer
+        run: pnpm run package:win
+      - name: List artifacts
+        run: Get-ChildItem release
+      - name: Upload installer to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          $exts = @('.exe', '.dmg', '.zip', '.AppImage', '.deb')
+          $files = Get-ChildItem release -File | Where-Object { $exts -contains $_.Extension }
+          if (-not $files) { throw "no uploadable artifacts found in release/" }
+          gh release upload $env:TAG @($files.FullName) --clobber
+
+  macos:
+    name: macOS installers (dmg + zip, x64 + arm64)
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - name: Enable pnpm via corepack
+        run: |
+          corepack enable pnpm
+          pnpm --version
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Detect signing capability
+        id: signing
+        env:
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: |
+          if security find-identity -v -p codesigning | grep -q "Developer ID Application: Yang Zhang (9PDD8M2SMS)" && [ -n "$APPLE_API_ISSUER" ]; then
+            echo "signed=true" >> "$GITHUB_OUTPUT"
+            echo "Developer ID identity and notarization credentials found: building signed + notarized installers."
+          else
+            echo "signed=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::Building ad-hoc-signed, un-notarized macOS installers. To enable signing + notarization, see the setup steps in the header of this workflow file."
+          fi
+      - name: Build installers (signed + notarized)
+        if: steps.signing.outputs.signed == 'true'
+        env:
+          APPLE_API_KEY: ${{ github.workspace }}/ApiKey_ZDCSZ5IE7071.p8
+          APPLE_API_KEY_ID: ZDCSZ5IE7071
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        # forceCodeSigning makes a signing failure fail the build instead of
+        # silently attaching unsigned installers to the release.
+        run: |
+          pnpm build
+          pnpm exec electron-builder --mac --x64 --arm64 --publish never -c.forceCodeSigning=true
+      - name: Build installers (ad-hoc fallback)
+        if: steps.signing.outputs.signed != 'true'
+        run: |
+          pnpm build
+          pnpm exec electron-builder --mac --x64 --arm64 --publish never --config electron-builder.unsigned.yml
+      - name: List artifacts
+        run: ls -la release
+      - name: Upload installers to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.event.release.tag_name || inputs.tag }}
+        run: |
+          shopt -s nullglob
+          files=(release/*.dmg release/*.zip)
+          if [ ${#files[@]} -eq 0 ]; then
+            echo "no uploadable artifacts found in release/" >&2
+            exit 1
+          fi
+          gh release upload "$TAG" "${files[@]}" --clobber