Harden package release workflows for Gitea

docs/PACKAGE_REGISTRY_RELEASES.md

@@ -18,24 +18,43 @@ python tools/repo/sync-module-package-workflows.py --check
 ```
 
 The workflow runs for `v*` tags and may be dispatched manually for an existing
-tag. Before building, it verifies that:
+tag. The organization preflight verifies that every package repository protects
+the `v*` namespace. Before building, the workflow itself verifies that:
 
-- the selected tag is covered by repository tag protection;
 - the tagged commit is contained in `main`;
 - the tag, Python project version, and optional WebUI package version agree;
 - package names remain in the `govoplan-*` and `@govoplan/*-webui` namespaces.
 
+The workflow binds the repository explicitly from the Gitea Actions context.
+Do not rely on GitHub-compatible environment variables being injected by the
+runner image; Gitea runners may expose only the context values. Gitea 1.24 job
+tokens cannot read repository tag-protection settings, so package jobs must not
+receive a broad administrator token merely to repeat the organization preflight.
+Run the following before the first publication and after repository or tag-rule
+changes:
+
+```bash
+python tools/gitea/gitea-configure-package-releases.py
+```
+
 It builds one wheel and, where applicable, one npm tarball. The workflow records
 the source tag, source commit, filename, size, and SHA-256 in
 `package-artifacts.json` before publishing. Gitea rejects a second upload of the
 same package version, so correction requires a new version rather than artifact
 replacement.
 
+The npm tarball is always published through an explicit local `./dist/...`
+path. Without that prefix, npm may interpret a relative tarball name as a Git
+package shorthand before it ever contacts the configured registry.
+
 Published WebUI packages contain registry-compatible dependencies only. The
 workflow converts an internal dependency pinned to a protected `vX.Y.Z` Git tag
 into the exact `X.Y.Z` registry version and rejects unresolved `file:` or Git
 dependencies. Repository development metadata may therefore keep local or Git
 references without leaking them into the published package contract.
+Historical `add-ideas` and current `GovOPlaN` organization URLs are accepted
+for immutable tagged releases; both normalize to the same exact registry
+dependency and no branch or unversioned Git reference is accepted.
 
 ## One-time Gitea setup