Return the forge to Gitea: releases, self-update, links, CI

The GitHub account is gone again, so git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI
is the canonical repo. Reverse f7a4cb6:

- .gitea/workflows/release.yml: restore the Gitea edition retired in f7a4cb6
  (draft release, per-target upload, SHA256SUMS, then publish). The Windows
  leg runs on the windows-amd64 label the current runner advertises.
- .github/workflows/{release,warm-cache}.yml: drop them; they target hosted
  GitHub runners and softprops, and Gitea ignores them once .gitea exists.
- kigi-env: update_base_url defaults to the Gitea Releases API again.
- install.sh / install.ps1: resolve releases from git.zacharyzhang.com.
- feedback, /docs, SECURITY.md, frontend worker + site: repo, issues and
  raw-file links point at git.zacharyzhang.com.
- docs/RELEASE.md: Gitea edition of the checklist with the current runners.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -68,7 +68,7 @@ a design against the 0.1.15 teardown), MCP servers on protocol 2026-07-28
 ## Hard constraints
 
 - **Zero egress**: only `auth.kimi.com`, `api.kimi.com`, `api.moonshot.cn`,
-  `api.moonshot.ai`, GitHub Releases, user-configured MCP servers, credentialed
+  `api.moonshot.ai`, Gitea Releases (`git.zacharyzhang.com`), user-configured MCP servers, credentialed
   provider endpoints, and `models.dev` (metadata refresh, ONLY when an enabled
   platform's `/models` lacks it — `wire_serves_metadata=false`, never
   Kimi/Moonshot, `KIGI_MODELS_DEV_URL=0` disables). No telemetry, no analytics,
@@ -640,4 +640,4 @@ client-side, no backend surface.
   grok.com references live only there and in `kigi-sampler`/proxy types.
 - M2: server-side search/fetch (F5), command parity with kimi-cli 1.49.0
   (F6), one-time `~/.kimi/config.toml` import (F7), F9 smoke list, perf CI.
-- M3: GitHub Releases distribution, install scripts, self-update (F8).
+- M3: Gitea Releases distribution, install scripts, self-update (F8).