Add self-update, including in Docker

Sandbar can install new releases itself using Reef's selfupdate, automatically with
SANDBAR_AUTO_UPDATE=1 or from a button on the Account page. In a container the new binary is
written to <data>/bin and takes over from the image at start, until the image catches up.
Tags now publish a Gitea release with archives and SHA256SUMS as well as the image.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -1,18 +1,22 @@
 name: Release
 
-# Push a tag such as v0.1.0 to build and publish the container image:
-#   git tag -a v0.1.0 -m "sandbar v0.1.0" && git push origin v0.1.0
+# Push a tag such as v0.2.0 to build and publish a release:
+#   git tag -a v0.2.0 -m "sandbar v0.2.0" && git push origin v0.2.0
+# The release carries the archives and SHA256SUMS that self-update downloads, and the
+# container image is pushed to the registry on this server.
 on:
   push:
     tags: ['v*']
 
 jobs:
-  image:
+  release:
     runs-on: ubuntu-latest
     env:
       GOPRIVATE: git.veillax.com
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # release notes come from the history since the previous tag
 
       - uses: actions/setup-go@v5
         with:
@@ -28,19 +32,22 @@ jobs:
           go vet ./...
           go test ./...
 
-      # The Dockerfile packages these binaries, so the arm64 image needs no emulation.
-      - name: Build the binaries
-        run: |
-          for a in amd64 arm64; do
-            mkdir -p dist/bin/linux_$a
-            CGO_ENABLED=0 GOOS=linux GOARCH=$a go build -trimpath \
-              -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" \
-              -o dist/bin/linux_$a/sandbar ./cmd/sandbar
-          done
+      - name: Build release archives
+        run: sh deploy/build.sh "${GITHUB_REF_NAME}"
 
-      # Optional secret REGISTRY_TOKEN (and variable REGISTRY_USER): an access token with
-      # package write permission, for servers where the job token can't push.
+      # Optional secret RELEASE_TOKEN: an access token that can write releases, for
+      # servers where the automatic job token can't.
+      - name: Publish the release
+        env:
+          TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        run: sh deploy/publish-release.sh "${GITHUB_REF_NAME}"
+
+      # Skipped when the repository variable PUBLISH_DOCKER is "false", or fails alone
+      # if this runner has no Docker: the release above is already published by then.
+      # Optional secret REGISTRY_TOKEN (and variable REGISTRY_USER): an access token
+      # with package write permission, for servers where the job token can't push.
       - name: Build and push the container image
+        if: ${{ vars.PUBLISH_DOCKER != 'false' }}
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
           REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}