CI: build installers on release publish and attach them to the Gitea release

- .gitea/workflows/release-build.yml: on release published (plus a manual
  back-fill trigger), build the Windows NSIS installer and macOS dmg/zip
  (x64 + arm64) on the self-hosted runners and upload them to the release.
- scripts/ci/upload-release-assets.mjs: attaches release/ artifacts via the
  Gitea API; uploads first, then removes stale same-named assets.
- electron-builder.unsigned.yml: ad-hoc fallback config used while the mac
  runner has no Developer ID identity / notarization credentials.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

electron-builder.unsigned.yml

@@ -0,0 +1,14 @@
+# CI fallback config: used by the release workflow when the runner has no
+# "Developer ID Application" identity in its keychain or the APPLE_API_ISSUER
+# secret is missing.
+#
+# identity "-" ad-hoc signs the bundle so it carries a fresh valid signature;
+# leaving it unsigned (identity: null) would keep the Electron dist's stale
+# signature, which macOS on Apple Silicon rejects outright as "damaged".
+# Ad-hoc builds are still not notarized: on first launch users must allow the
+# app via System Settings > Privacy & Security (or `xattr -cr` the app).
+extends: ./electron-builder.yml
+mac:
+  identity: "-"
+  hardenedRuntime: false
+  notarize: false