feat: add CI release workflow for installers, AppImage and Docker

Gitea Actions workflow triggered on tag push or manual dispatch: builds
the Windows NSIS/portable installers and Linux AppImage, builds+pushes
the Docker image, then creates/updates the Gitea release with a
changelog-compare link as the body and all artifacts attached. Flatpak
stays local-only (build-release.ps1) since flatpak-builder's sandbox
isn't reliable on a containerized Actions runner.

Also fixes build-release.ps1: the win.signExecutable=false override
only applied when cross-building via the WSL path, not to a genuine
native-Linux build of the "win" target (the CI's case).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/build-release.ps1

@@ -616,8 +616,10 @@ try {
         # it would otherwise download is unusable there (see the header).
         #
         # Passed here rather than put in package.json so a native Windows build keeps
-        # behaving exactly as it did.
-        if ($useWslHere -and $wslTargets -contains $target -and $target -like "win*") {
+        # behaving exactly as it did. The same gap exists on a genuine Linux host (no
+        # WSL involved) building "win" directly — e.g. CI — so this checks $onWindows
+        # rather than $useWslHere.
+        if (-not $onWindows -and $target -like "win*") {
             $builderArgs += "-c.win.signExecutable=false"
         }