CI: migrate release workflow from GitHub Actions to Forgejo Actions

GitHub Actions self-hosted runners require per-repo registration on a
personal (non-org) account — every new bakery repo needed a manually
provisioned runner on hestia, which nobody had noticed was broken
until this session. Forgejo Actions' runner already serves every repo
with zero registration. Moves release.yml there (dl.breadway.dev is
the primary bakery fetch target either way; GitHub release upload is
kept as the fallback path, now via an explicit token since Forgejo
Actions has no ambient GITHUB_TOKEN), and adds a mirror workflow to
keep GitHub in sync automatically instead of manual dual-remote pushes.

.forgejo/workflows/mirror.yml

@@ -0,0 +1,19 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches: ['**']
+    tags: ['**']
+
+jobs:
+  mirror:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: Mirror to GitHub
+        run: |
+          set -euo pipefail
+          git clone --mirror "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" repo.git
+          cd repo.git
+          git push --prune \
+            "https://x-access-token:${{ secrets.MIRROR_TOKEN }}@github.com/Breadway/breadmon.git" \
+            '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'

.forgejo/workflows/release.yml

@@ -0,0 +1,53 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: build
+        run: cd src && cargo build --release --locked
+
+      - name: prepare artifacts
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG_DIR="/srv/breadway-dl/breadmon/${VERSION}"
+          mkdir -p "${PKG_DIR}"
+          cp "src/target/release/breadmon" "${PKG_DIR}/breadmon-x86_64"
+          strip "${PKG_DIR}/breadmon-x86_64"
+          sha256sum "${PKG_DIR}/breadmon-x86_64" | awk '{print $1}' \
+            > "${PKG_DIR}/breadmon-x86_64.sha256"
+          cp src/bakery.toml "${PKG_DIR}/bakery.toml"
+          ln -sfn "${VERSION}" "/srv/breadway-dl/breadmon/latest"
+
+      - name: regenerate index.json
+        run: |
+          set -euo pipefail
+          rm -rf /tmp/bread-ecosystem-ci
+          git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
+          bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
+
+      - name: upload to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG_DIR="/srv/breadway-dl/breadmon/${VERSION}"
+          gh release create "${GITHUB_REF_NAME}" --repo Breadway/breadmon \
+            --title "breadmon v${VERSION}" --generate-notes 2>/dev/null || true
+          gh release upload "${GITHUB_REF_NAME}" --repo Breadway/breadmon \
+            "${PKG_DIR}/breadmon-x86_64" \
+            "${PKG_DIR}/breadmon-x86_64.sha256" \
+            --clobber