Release setup: tarballs, Gitea workflow, apt registry

make dist builds tarballs for linux/amd64 and linux/arm64. A pushed v*
tag runs .gitea/workflows/release.yml, which checks the tag against
VERSION and the CHANGELOG, tests, builds the tarballs and the .debs
(amd64, arm64) and publishes them with scripts/gitea-release.sh: a Gitea
release, and the .debs in the Debian registry (stable, or testing for a
release candidate). As in Housecarl and Steward; no cli-dist, Guard is
Linux only. docs/development.md has the steps, docs/install.md the apt
source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -25,4 +25,6 @@ All notable changes to Guard are documented here. The format follows
   `test` (a watch's patterns over a log), `status` (through a local
   socket), `bans`, `ban`, `unban`, `version`.
 - A Debian package with a sandboxed systemd unit, as the `guard` user in
-  the `adm` and `systemd-journal` groups.
+  the `adm` and `systemd-journal` groups, published with each release to
+  the Gitea Debian registry (`stable`, or `testing` for a release
+  candidate) along with tarballs for Linux amd64 and arm64.