Return the forge to Gitea: releases, self-update, links, CI

The GitHub account is gone again, so git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI
is the canonical repo. Reverse f7a4cb6:

- .gitea/workflows/release.yml: restore the Gitea edition retired in f7a4cb6
  (draft release, per-target upload, SHA256SUMS, then publish). The Windows
  leg runs on the windows-amd64 label the current runner advertises.
- .github/workflows/{release,warm-cache}.yml: drop them; they target hosted
  GitHub runners and softprops, and Gitea ignores them once .gitea exists.
- kigi-env: update_base_url defaults to the Gitea Releases API again.
- install.sh / install.ps1: resolve releases from git.zacharyzhang.com.
- feedback, /docs, SECURITY.md, frontend worker + site: repo, issues and
  raw-file links point at git.zacharyzhang.com.
- docs/RELEASE.md: Gitea edition of the checklist with the current runners.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/codegen/kigi-update/src/auto_update.rs

@@ -695,7 +695,7 @@ pub(crate) fn detect_platform() -> Result<(&'static str, &'static str)> {
 
 /// Rust target triple for this build — the key that maps a platform to its
 /// release-asset name. Must stay in lockstep with the five targets built by
-/// `.github/workflows/release.yml` and the tables in install.sh/install.ps1.
+/// `.gitea/workflows/release.yml` and the tables in install.sh/install.ps1.
 pub(crate) fn target_triple() -> Result<&'static str> {
     let triple = if cfg!(all(target_os = "macos", target_arch = "aarch64")) {
         "aarch64-apple-darwin"
@@ -2653,7 +2653,7 @@ mod tests {
     #[cfg(any(target_arch = "x86_64", target_arch = "aarch64"))]
     #[test]
     fn test_release_asset_name_matches_release_workflow_naming() {
-        // Must stay in lockstep with .github/workflows/release.yml, which
+        // Must stay in lockstep with .gitea/workflows/release.yml, which
         // publishes kigi-<version>-<target-triple>.{tar.gz|zip}.
         let triple = target_triple().unwrap();
         assert!(

crates/codegen/kigi-update/src/version.rs

@@ -10,7 +10,7 @@ const TTL_SECONDS_BEFORE_AUTO_UPDATE: Duration = Duration::from_secs(60 * 30);
 
 /// Release channel: this repo's Releases (PRD F8). The API base is resolved
 /// through [`kigi_env::update_base_url`] — production default
-/// `https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
+/// `https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
 /// overridable via `KIGI_UPDATE_BASE_URL` for mirrors and tests.
 pub(crate) fn update_base_url() -> String {
     kigi_env::update_base_url()
@@ -533,7 +533,7 @@ mod tests {
     #[test]
     fn test_release_json_parses_github_wire_shape() {
         let json = r#"{
-            "url": "https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases/1",
+            "url": "https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases/1",
             "tag_name": "v0.1.0",
             "name": "Kigi 0.1.0",
             "draft": false,
@@ -541,13 +541,13 @@ mod tests {
             "assets": [
                 {
                     "name": "kigi-0.1.0-aarch64-apple-darwin.tar.gz",
-                    "browser_download_url": "https://github.com/ZacharyZhang-NY/Kigi-CLI/releases/download/v0.1.0/kigi-0.1.0-aarch64-apple-darwin.tar.gz",
+                    "browser_download_url": "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/releases/download/v0.1.0/kigi-0.1.0-aarch64-apple-darwin.tar.gz",
                     "size": 123,
                     "content_type": "application/gzip"
                 },
                 {
                     "name": "SHA256SUMS",
-                    "browser_download_url": "https://github.com/ZacharyZhang-NY/Kigi-CLI/releases/download/v0.1.0/SHA256SUMS"
+                    "browser_download_url": "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/releases/download/v0.1.0/SHA256SUMS"
                 }
             ]
         }"#;
@@ -560,7 +560,7 @@ mod tests {
         let asset = r.asset("kigi-0.1.0-aarch64-apple-darwin.tar.gz").unwrap();
         assert_eq!(
             asset.browser_download_url,
-            "https://github.com/ZacharyZhang-NY/Kigi-CLI/releases/download/v0.1.0/kigi-0.1.0-aarch64-apple-darwin.tar.gz"
+            "https://git.zacharyzhang.com/ZacharyZhang-NY/Kigi-CLI/releases/download/v0.1.0/kigi-0.1.0-aarch64-apple-darwin.tar.gz"
         );
         assert_eq!(
             r.asset("SHA256SUMS").unwrap().name,