fix(release): port store publishing to Forgejo Actions (canonical remote is Forgejo)

git.comunes.org runs Forgejo Actions, not GitLab CI, so the tag-triggered
signed-AAB build + fastlane Play upload now lives in .forgejo/workflows/release.yml
(single job, no cross-job artifact passing). Removed the equivalent GitLab jobs;
.gitlab-ci.yml keeps only the analyze/test gate. Play service account is reused
from Ğ1nkgo. docs/release.md updated (Forgejo secrets).

.gitlab-ci.yml

@@ -10,7 +10,6 @@ stages:
   - analyze
   - test
   - build
-  - deploy
 
 variables:
   PUB_CACHE: "$CI_PROJECT_DIR/.pub-cache"
@@ -84,62 +83,6 @@ test:app_seeds:
         coverage_format: cobertura
         path: apps/app_seeds/coverage/cobertura.xml
 
-# ---------------------------------------------------------------------------
-# Release automation. Runs ONLY on tags, so it never touches the per-push gate.
-# Password-free: signing + Play credentials come from masked+protected CI vars.
-# Required CI variables (Settings > CI/CD > Variables), set once:
-#   TANE_KEYSTORE_BASE64   base64 of the dedicated Tane upload keystore (.jks)
-#   TANE_KEYSTORE_PASSWORD store password
-#   TANE_KEY_ALIAS         key alias (tane-upload)
-#   TANE_KEY_PASSWORD      key password
-#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON (raw file contents)
-# Tag a commit (e.g. `git tag v0.1.0 && git push --tags`) to build + publish.
-# ---------------------------------------------------------------------------
-
-# Build the signed release artifacts (AAB for Play, APK for sideload/QA).
-build:android:
-  stage: build
-  rules:
-    - if: '$CI_COMMIT_TAG'
-  script:
-    - cd apps/app_seeds
-    - dart run slang
-    - dart run build_runner build --delete-conflicting-outputs
-    # Materialize the signing material from CI secrets (never in the repo).
-    - echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$CI_PROJECT_DIR/tane-upload.jks"
-    - |
-      cat > android/key.properties <<EOF
-      storeFile=$CI_PROJECT_DIR/tane-upload.jks
-      storePassword=$TANE_KEYSTORE_PASSWORD
-      keyAlias=$TANE_KEY_ALIAS
-      keyPassword=$TANE_KEY_PASSWORD
-      EOF
-    - flutter build appbundle --release
-    - flutter build apk --release
-    # Don't leave signing material in the workspace/cache.
-    - rm -f android/key.properties "$CI_PROJECT_DIR/tane-upload.jks"
-  artifacts:
-    paths:
-      - apps/app_seeds/build/app/outputs/bundle/release/app-release.aab
-      - apps/app_seeds/build/app/outputs/flutter-apk/app-release.apk
-    expire_in: 90 days
-
-# Upload the AAB + store listing to Google Play (internal track) via fastlane.
-# Needs a Ruby image, not the Flutter one, so it overrides the global setup.
-deploy:play:
-  stage: deploy
-  image: ruby:3.2
-  needs:
-    - job: build:android
-      artifacts: true
-  rules:
-    - if: '$CI_COMMIT_TAG'
-  before_script:
-    - cd apps/app_seeds
-    - bundle install --path vendor/bundle
-  script:
-    - bundle exec fastlane deploy_play
-  cache:
-    key: "fastlane-gems"
-    paths:
-      - apps/app_seeds/vendor/bundle/
+# Release automation (signed AAB + Play upload on tag) lives in Forgejo Actions,
+# since the canonical remote (git.comunes.org) is Forgejo, not GitLab:
+#   .forgejo/workflows/release.yml