Release setup: tarballs, Gitea workflow, apt registry

make dist builds tarballs for linux/amd64 and linux/arm64. A pushed v*
tag runs .gitea/workflows/release.yml, which checks the tag against
VERSION and the CHANGELOG, tests, builds the tarballs and the .debs
(amd64, arm64) and publishes them with scripts/gitea-release.sh: a Gitea
release, and the .debs in the Debian registry (stable, or testing for a
release candidate). As in Housecarl and Steward; no cli-dist, Guard is
Linux only. docs/development.md has the steps, docs/install.md the apt
source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -51,7 +51,8 @@ make e2e      # with ../housecarl's lab: needs Docker (DOCKER_HOST=unix:///var/r
 
 As in Housecarl: commit only when asked, never push; branches
 `dev-X.Y.Z`; a release is a commit "Release X" setting `VERSION`, with
-the annotated tag `vX` ("Guard X").
+the annotated tag `vX` ("Guard X"). Pushing the tag runs
+`.gitea/workflows/release.yml` (docs/development.md, "Releasing").
 
 ## Shell hygiene