Publish cn-built packages to the omarchycn registry before each release

packages/publish-cn-packages.sh uploads the omarchy-dev and
omarchy-settings-dev builds (token via curl config on stdin), and the
release checklist runs it as step 8 ahead of the public Release so the
one-click convert never installs stale packages.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019hLK3wsDuKVAC37GgDqg6H

docs/release-checklist.md

@@ -9,9 +9,11 @@
 5. `sha256sum` → `SHA256SUMS.txt`；签名 SUMS 与 ISO（发布子钥）
 6. SBOM 两份：syft（live airootfs）+ 离线仓库 .PKGINFO 采集
 7. `release.json`（版本、双向提交、包版本表、迁移列表、min_compatible、产物清单）→ 签名 release.json
-8. 建 tag 与 Release，上传全部产物，Release Notes 写明上游基线与已知问题
-9. 匿名回读已发布 ISO 并 sha256 复核 == 本地构建值
-10. `cn/release` 数字 +1，提交
+8. 把本次构建的 `omarchy-dev` / `omarchy-settings-dev` 发布到 [omarchycn] registry
+    （`packages/publish-cn-packages.sh`；先于公开 Release，一键转换才不会装到旧包）
+9. 建 tag 与 Release，上传全部产物，Release Notes 写明上游基线与已知问题
+10. 匿名回读已发布 ISO 并 sha256 复核 == 本地构建值
+11. `cn/release` 数字 +1，提交
 
 ## 版本规则
 

packages/publish-cn-packages.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Publishes cn-built packages into the Gitea [omarchycn] Arch registry.
+# usage: publish-cn-packages.sh <pkg.tar.zst>... (maintainer/release step)
+
+set -euo pipefail
+
+GITEA=${GITEA:-https://git.zacharyzhang.com}
+OWNER=${OWNER:-ZacharyZhang-NY}
+: "${PKG_SYNC_TOKEN:?PKG_SYNC_TOKEN (Gitea package-write token) is required}"
+(($# > 0)) || { echo "usage: publish-cn-packages.sh <pkg.tar.zst>..." >&2; exit 1; }
+
+for pkg in "$@"; do
+  [[ -f $pkg ]] || { echo "no such file: $pkg" >&2; exit 1; }
+  # Token travels via curl config on stdin, never in the process argument list
+  code=$(curl -sS --retry 2 -o /tmp/publish.out -w '%{http_code}' -X PUT -K - \
+    --upload-file "$pkg" "$GITEA/api/packages/$OWNER/arch/omarchycn" \
+    <<< "header = \"Authorization: token $PKG_SYNC_TOKEN\"")
+  case "$code" in
+  201) echo "published: ${pkg##*/}" ;;
+  409) echo "already present: ${pkg##*/}" ;;
+  *)
+    echo "upload of ${pkg##*/} failed (HTTP $code): $(head -c 300 /tmp/publish.out)" >&2
+    exit 1
+    ;;
+  esac
+done