feat(release): publish desktop updates from a tag through one feed

Desktop clients had two competing update sources: the runtime pointed at a
legacy GitLab registry while the Forgejo packages were filled in by
hardcoded, version-pinned scripts. Operators could not tell which feed was
authoritative, and no release could be reproduced from a tag.

Auto-update now reads a single canonical Forgejo registry feed, updated by
a version-agnostic publisher that runs from the tag on Forgejo, GitLab, and
GitHub CI alike. Channel, minimum supported version, forced install,
full-versus-delta thresholds, staged rollout, and a remote kill switch come
from one policy file the client fetches alongside the feed. Tag creation is
gated on a clean tree, matching version surfaces, and a changelog section.

scripts/lib/credentials.cjs

@@ -0,0 +1,30 @@
+'use strict'
+
+function requireEnvironment(name) {
+  const value = process.env[name]?.trim()
+  if (!value) {
+    throw new Error(`${name} is required`)
+  }
+  return value
+}
+
+function forgejoLogin() {
+  return {
+    username: requireEnvironment('FORGEJO_USERNAME'),
+    password: requireEnvironment('FORGEJO_PASSWORD'),
+  }
+}
+
+function forgejoAuthorization() {
+  const token = process.env.FORGEJO_TOKEN?.trim()
+  if (token) return `token ${token}`
+
+  const { username, password } = forgejoLogin()
+  return `Basic ${Buffer.from(`${username}:${password}`, 'utf8').toString('base64')}`
+}
+
+module.exports = {
+  forgejoAuthorization,
+  forgejoLogin,
+  requireEnvironment,
+}