ci: make apt registry upload idempotent (tolerate 409)

Gitea's Debian registry is immutable, so re-uploading an existing version returns
409. With --fail that aborted the release on any re-run / repeat push at the same
version. Now we capture the HTTP code: 2xx = uploaded, 409 = already published
(skip), anything else = fail with the body. Also fixed the stale skip message
(REGISTRY_TOKEN, not PACKAGES_TOKEN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -113,13 +113,19 @@ jobs:
         run: |
           set -euo pipefail
           if [ -z "${PKG_TOKEN:-}" ]; then
-            echo "PACKAGES_TOKEN not set — skipping apt publish (the .deb is still a release asset)."
+            echo "REGISTRY_TOKEN not set — skipping apt publish (the .deb is still a release asset)."
             exit 0
           fi
           OWNER="${{ github.repository_owner }}"
           URL="${{ github.server_url }}/api/packages/${OWNER}/debian/pool/stable/main/upload"
           for f in dist/*.deb; do
             echo "Uploading $(basename "$f") to the apt registry…"
-            curl -sS --fail --user "${OWNER}:${PKG_TOKEN}" --upload-file "$f" "$URL"
+            code=$(curl -sS -o /tmp/apt_upload.txt -w '%{http_code}' \
+              --user "${OWNER}:${PKG_TOKEN}" --upload-file "$f" "$URL" || true)
+            case "$code" in
+              2*)  echo "  uploaded ($code)";;
+              409) echo "  already published ($code) — skipping (registry versions are immutable)";;
+              *)   echo "  upload failed ($code):"; cat /tmp/apt_upload.txt || true; exit 1;;
+            esac
           done
           echo "apt source: deb ${{ github.server_url }}/api/packages/${OWNER}/debian stable main"