Release setup: tarballs, Gitea workflow, apt registry

make dist builds tarballs for linux/amd64 and linux/arm64. A pushed v*
tag runs .gitea/workflows/release.yml, which checks the tag against
VERSION and the CHANGELOG, tests, builds the tarballs and the .debs
(amd64, arm64) and publishes them with scripts/gitea-release.sh: a Gitea
release, and the .debs in the Debian registry (stable, or testing for a
release candidate). As in Housecarl and Steward; no cli-dist, Guard is
Linux only. docs/development.md has the steps, docs/install.md the apt
source.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/install.md

@@ -28,11 +28,26 @@ A watch that reads Housecarl's own log (`housecarl-drops`) also needs
 
 ## 2. The package
 
+Guard's releases publish its Debian package to the same Gitea registry
+as Jarl's, Steward's and Housecarl's: `stable` for releases, `testing`
+for release candidates. If apt already has it, `sudo apt install guard`
+is all it takes. Otherwise add it:
+
 ```sh
-sudo apt install ./guard_0.1.0_amd64.deb
+sudo install -d /etc/apt/keyrings
+sudo curl -fsSL https://gitea.adbraun.lol/api/packages/adam/debian/repository.key -o /etc/apt/keyrings/gitea-adam.asc
+echo "deb [signed-by=/etc/apt/keyrings/gitea-adam.asc] https://gitea.adbraun.lol/api/packages/adam/debian stable main" \
+  | sudo tee /etc/apt/sources.list.d/gitea-adam.list
+sudo apt update
+sudo apt install guard
 ```
 
-It makes the `guard` user (in the `adm` and `systemd-journal` groups,
+For release candidates too, add the `testing` distribution: the same
+`deb` line with `testing` instead of `stable`. The release page also has
+the `.deb` files (`sudo apt install ./guard_0.1.0_amd64.deb`) and
+tarballs for Linux amd64 and arm64.
+
+The package makes the `guard` user (in the `adm` and `systemd-journal` groups,
 to read logs), installs `guard.service` without starting it, and writes
 an example `/etc/guard/guard.yaml`.