Mutable tags on third-party actions could be repointed at code that
runs with the repo token; pin checkout, upload-artifact and
gitea-release-action to their current commits.
Every push to main builds the addon zip + registry metadata as a CI
artifact; pushing a v<version> tag (checked against metadata.json)
creates a release with both attached, matching the download_url
convention build_package.py already writes.
grabowski