Publish cn-built packages to the omarchycn registry before each release

packages/publish-cn-packages.sh uploads the omarchy-dev and
omarchy-settings-dev builds (token via curl config on stdin), and the
release checklist runs it as step 8 ahead of the public Release so the
one-click convert never installs stale packages.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019hLK3wsDuKVAC37GgDqg6H

packages/publish-cn-packages.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+# Publishes cn-built packages into the Gitea [omarchycn] Arch registry.
+# usage: publish-cn-packages.sh <pkg.tar.zst>... (maintainer/release step)
+
+set -euo pipefail
+
+GITEA=${GITEA:-https://git.zacharyzhang.com}
+OWNER=${OWNER:-ZacharyZhang-NY}
+: "${PKG_SYNC_TOKEN:?PKG_SYNC_TOKEN (Gitea package-write token) is required}"
+(($# > 0)) || { echo "usage: publish-cn-packages.sh <pkg.tar.zst>..." >&2; exit 1; }
+
+for pkg in "$@"; do
+  [[ -f $pkg ]] || { echo "no such file: $pkg" >&2; exit 1; }
+  # Token travels via curl config on stdin, never in the process argument list
+  code=$(curl -sS --retry 2 -o /tmp/publish.out -w '%{http_code}' -X PUT -K - \
+    --upload-file "$pkg" "$GITEA/api/packages/$OWNER/arch/omarchycn" \
+    <<< "header = \"Authorization: token $PKG_SYNC_TOKEN\"")
+  case "$code" in
+  201) echo "published: ${pkg##*/}" ;;
+  409) echo "already present: ${pkg##*/}" ;;
+  *)
+    echo "upload of ${pkg##*/} failed (HTTP $code): $(head -c 300 /tmp/publish.out)" >&2
+    exit 1
+    ;;
+  esac
+done