GitHub Actions self-hosted runners require per-repo registration on a
personal (non-org) account — every new bakery repo needed a manually
provisioned runner on hestia, which nobody had noticed was broken
until this session. Forgejo Actions' runner already serves every repo
with zero registration. Moves release.yml there (dl.breadway.dev is
the primary bakery fetch target either way; GitHub release upload is
kept as the fallback path, now via an explicit token since Forgejo
Actions has no ambient GITHUB_TOKEN), and adds a mirror workflow to
keep GitHub in sync automatically instead of manual dual-remote pushes.
