docs(release): note Forgejo Actions runner is missing on aaron + keystore alias

aaron runs forgejo + jenkins but no act_runner, so workflows queue until a runner
is registered (or CI moves to Jenkins). Record that the keystore alias is tane-upload.

docs/release.md

@@ -74,6 +74,22 @@ not to one app, so it just needs access granted to `org.comunes.tane` in Play Co
 app must still be done by hand in the console (Play requires the app to exist before
 the API accepts uploads).
 
+## CI runner (Forgejo Actions) — action needed
+
+The release + gate workflows (`.forgejo/workflows/*.yml`) run on **Forgejo Actions**,
+which needs a **registered runner**. As of 2026-07-16 the `aaron` host runs the
+`forgejo` and `jenkins` containers but **no Forgejo Actions runner** — so the
+workflows will queue and never start until one is registered. Two options:
+
+- **Register an act_runner** on `aaron` (a `forgejo-runner`/`act_runner` container
+  registered against `git.comunes.org` with a label matching `runs-on:` — currently
+  `docker`). Then tag → build → publish works as designed.
+- **Or move CI to Jenkins** (already running on `aaron`) via a Jenkinsfile; the build
+  and `fastlane deploy_play` steps are the same shell commands.
+
+Also: the keystore's real alias is **`tane-upload`**, so the Forgejo secret
+`TANE_KEY_ALIAS` and local `key.properties` must both use `tane-upload`.
+
 ## Build by hand (fallback / first Play upload)
 
 ```bash