Fix dispatch failures and disable automatic cleanup

1. Quote RELEASE_TAG env vars in all workflow files. Unquoted
   ${{ inputs.tag }} caused YAML parse errors on some Gitea runners,
   making dispatch return HTTP 500 for Linux/macOS.

2. Disable automatic release cleanup in both coordinators. The cleanup
   races with async builds -- it deletes the release before builds
   finish uploading their assets. Clean up old releases manually
   from the Gitea UI instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-app-linux.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       NODE_VERSION: "20"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         run: echo "Building for tag: ${RELEASE_TAG}"

.gitea/workflows/build-app-macos.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: macos-latest
     env:
       NODE_VERSION: "20"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         run: echo "Building for tag: ${RELEASE_TAG}"

.gitea/workflows/build-app-windows.yml

@@ -15,7 +15,7 @@ jobs:
     name: Build App (Windows)
     runs-on: windows-latest
     env:
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         shell: powershell

.gitea/workflows/build-sidecar-cloud.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       PYTHON_VERSION: "3.11"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         run: echo "Building cloud sidecar for tag ${RELEASE_TAG}"
@@ -85,7 +85,7 @@ jobs:
     runs-on: windows-latest
     env:
       PYTHON_VERSION: "3.11"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         shell: powershell
@@ -161,7 +161,7 @@ jobs:
     runs-on: macos-latest
     env:
       PYTHON_VERSION: "3.11"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         run: echo "Building cloud sidecar for tag ${RELEASE_TAG}"

.gitea/workflows/build-sidecar-linux.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       PYTHON_VERSION: "3.11"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         run: echo "Building for tag: ${RELEASE_TAG}"

.gitea/workflows/build-sidecar-macos.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: macos-latest
     env:
       PYTHON_VERSION: "3.11"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         run: echo "Building for tag: ${RELEASE_TAG}"

.gitea/workflows/build-sidecar-windows.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: windows-latest
     env:
       PYTHON_VERSION: "3.11"
-      RELEASE_TAG: ${{ inputs.tag }}
+      RELEASE_TAG: "${{ inputs.tag }}"
     steps:
       - name: Show tag
         shell: powershell

.gitea/workflows/release.yml

@@ -118,42 +118,5 @@ jobs:
             [ "$HTTP_CODE" != "204" ] && cat /tmp/dispatch_resp.txt && echo ""
           done
 
-      - name: Clean up old app releases
+      # NOTE: Automatic cleanup disabled -- it races with async builds.
-        env:
+      # Clean up old releases manually from the Gitea UI when needed.
-          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
-        run: |
-          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
-          KEEP=3
-          PROTECT_TAG="v1.4.0"
-
-          echo "Cleaning up old app releases (keeping latest ${KEEP} + ${PROTECT_TAG})..."
-
-          # Get all app releases (v* tags, not sidecar-v*)
-          RELEASES=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
-            "${REPO_API}/releases?limit=50" | jq -c '[.[] | select(.tag_name | startswith("v")) | select(.tag_name | startswith("sidecar") | not)]')
-
-          TOTAL=$(echo "$RELEASES" | jq 'length')
-          echo "Found ${TOTAL} app releases"
-
-          if [ "$TOTAL" -le "$KEEP" ]; then
-            echo "Nothing to clean up"
-            exit 0
-          fi
-
-          # Skip the newest KEEP releases, delete the rest (except protected)
-          echo "$RELEASES" | jq -c ".[$KEEP:][]" | while read -r release; do
-            ID=$(echo "$release" | jq -r '.id')
-            TAG=$(echo "$release" | jq -r '.tag_name')
-
-            if [ "$TAG" = "$PROTECT_TAG" ]; then
-              echo "  Protecting ${TAG}"
-              continue
-            fi
-
-            echo "  Deleting release ${TAG} (ID: ${ID})..."
-            curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
-              "${REPO_API}/releases/${ID}"
-            # Keep the git tag -- only delete the release (assets).
-            # Deleting tags breaks builds that haven't checked out yet.
-          done
-          echo "Cleanup complete"

.gitea/workflows/sidecar-release.yml

@@ -128,37 +128,5 @@ jobs:
             echo "  -> HTTP ${HTTP_CODE}"
           done
 
-      - name: Clean up old sidecar releases
+      # NOTE: Automatic cleanup disabled -- it races with async builds.
-        if: steps.check_changes.outputs.has_changes == 'true'
+      # Clean up old releases manually from the Gitea UI when needed.
-        env:
-          BUILD_TOKEN: ${{ secrets.BUILD_TOKEN }}
-        run: |
-          REPO_API="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
-          KEEP=2
-
-          echo "Cleaning up old sidecar releases (keeping latest ${KEEP})..."
-
-          # Get all sidecar releases (sidecar-v* tags)
-          RELEASES=$(curl -s -H "Authorization: token ${BUILD_TOKEN}" \
-            "${REPO_API}/releases?limit=50" | jq -c '[.[] | select(.tag_name | startswith("sidecar-v"))]')
-
-          TOTAL=$(echo "$RELEASES" | jq 'length')
-          echo "Found ${TOTAL} sidecar releases"
-
-          if [ "$TOTAL" -le "$KEEP" ]; then
-            echo "Nothing to clean up"
-            exit 0
-          fi
-
-          # Skip the newest KEEP releases, delete the rest
-          echo "$RELEASES" | jq -c ".[$KEEP:][]" | while read -r release; do
-            ID=$(echo "$release" | jq -r '.id')
-            TAG=$(echo "$release" | jq -r '.tag_name')
-
-            echo "  Deleting sidecar release ${TAG} (ID: ${ID})..."
-            curl -s -X DELETE -H "Authorization: token ${BUILD_TOKEN}" \
-              "${REPO_API}/releases/${ID}"
-            # Keep the git tag -- only delete the release (assets).
-            # Deleting tags breaks builds that haven't checked out yet.
-          done
-          echo "Cleanup complete"