feat: releases from GitHub first, then git.kebcloud.no; releases sets others

Updates and install.sh try the GitHub mirror, then git.kebcloud.no,
each with a short timeout, and download from the first server with the
release, checked against its checksums.txt. The releases config option
(and LAZYSECRETS_RELEASES for install.sh) lists other servers. The
release workflow copies each release to GitHub when GH_RELEASE_TOKEN is
set. The status pane's issues link points to GitHub.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/config/config_test.go

@@ -70,6 +70,8 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"old layout": "azure:\n  vaults: [https://kv.vault.azure.net/]\n",
 		"duration":   "timeout: soon\n",
 		"view":       "sourcesView: tree\n",
+		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
+		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
 	} {
 		if _, err := Load(write(t, content)); err == nil {
 			t.Errorf("%s: no error", name)
@@ -113,6 +115,13 @@ theme:
 	}
 }
 
+func TestReleases(t *testing.T) {
+	c, err := Load(write(t, "releases: [https://git.example.com/team/lazysecrets]\n"))
+	if err != nil || len(c.Releases) != 1 {
+		t.Errorf("releases = %v, %v", c.Releases, err)
+	}
+}
+
 func TestLoadDelay(t *testing.T) {
 	c, err := Load(write(t, "loadDelay: 300ms\n"))
 	if err != nil || c.LoadDelay == nil || *c.LoadDelay != 300*time.Millisecond {