feat: releases from GitHub first, then git.kebcloud.no; releases sets others

Updates and install.sh try the GitHub mirror, then git.kebcloud.no,
each with a short timeout, and download from the first server with the
release, checked against its checksums.txt. The releases config option
(and LAZYSECRETS_RELEASES for install.sh) lists other servers. The
release workflow copies each release to GitHub when GH_RELEASE_TOKEN is
set. The status pane's issues link points to GitHub.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -4,8 +4,9 @@ name: Release
 # as a pre-release) tests lazysecrets, then GoReleaser (.goreleaser.yaml)
 # builds it for macOS and Linux, arm64 and amd64, and publishes a Gitea
 # release with the archives, checksums and this release's section of the
-# changelog (git-cliff, cliff.toml). Pushing the same tag again (after
-# deleting it) replaces the release.
+# changelog (git-cliff, cliff.toml), then copies it to the GitHub
+# mirror. Pushing the same tag again (after deleting it) replaces the
+# release in both places.
 #
 #   scripts/release.sh v0.2.0    # updates CHANGELOG.md, tags and pushes
 
@@ -81,3 +82,14 @@ jobs:
           args: release --clean --release-notes ${{ runner.temp }}/notes.md
         env:
           GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Copy the release to GitHub
+        # The same notes and files on the GitHub mirror, which lazysecrets
+        # updates from first (internal/update). GH_RELEASE_TOKEN is a
+        # fine-grained token that can write the mirror's contents; without
+        # it the step does nothing.
+        run: node scripts/github-release.mjs
+        env:
+          TAG: ${{ github.ref_name }}
+          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}