feat: releases from GitHub first, then git.kebcloud.no; releases sets others

Updates and install.sh try the GitHub mirror, then git.kebcloud.no,
each with a short timeout, and download from the first server with the
release, checked against its checksums.txt. The releases config option
(and LAZYSECRETS_RELEASES for install.sh) lists other servers. The
release workflow copies each release to GitHub when GH_RELEASE_TOKEN is
set. The status pane's issues link points to GitHub.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/development.md

@@ -56,8 +56,12 @@ from the pull request titles. The tag runs the release workflow
 (`.gitea/workflows/release.yml`): it tests, then
 [GoReleaser](https://goreleaser.com) (`.goreleaser.yaml`) builds the
 archives and publishes a Gitea release with them and the release's
-changelog section. `goreleaser release --snapshot --clean` builds the same
-archives locally, into `dist/`, without publishing.
+changelog section. Then `scripts/github-release.mjs` copies that release,
+notes and files, to the GitHub mirror, with the `GH_RELEASE_TOKEN`
+secret (a fine-grained token that can write the mirror's contents);
+without the secret it skips that. `goreleaser release --snapshot
+--clean` builds the same archives locally, into `dist/`, without
+publishing.
 
 A suffix (`v0.2.0-rc.1`) makes a pre-release, which leaves `CHANGELOG.md`
 alone.