Publish a fixed-URL "latest" AppImage for static-URL updaters

Gitea has no /releases/latest/download/ redirect and release URLs always
include the tag, so updaters that poll a constant URL (Shelly) cannot use
them. After publishing a vX.Y.Z release, replace the asset on a rolling
pre-release tagged "latest":

  .../releases/download/latest/WhatsThatMusic-latest-linux-x86_64.AppImage

Replacing the asset changes its ETag and Last-Modified, which Shelly
compares. The pre-release flag keeps Gitea's own "latest release" on the
newest vX.Y.Z. The logic lives in .gitea/scripts/update-latest.sh so it can
be run against the API outside CI. The publish job now checks out first,
since checkout cleans the workspace and would delete downloaded artifacts.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -129,6 +129,9 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     steps:
+      # Checkout first: it cleans the workspace, which would delete downloaded artifacts.
+      - uses: actions/checkout@v4
+
       - uses: actions/download-artifact@v3
         with:
           path: artifacts
@@ -198,3 +201,12 @@ jobs:
             exit 1
           fi
           echo "Attached $found artifacts to release $release_id"
+
+      # Constant-URL copy of the AppImage for updaters that poll a static URL
+      # (e.g. Shelly). Runs after the versioned release exists, so a failure here
+      # cannot leave a tag without its assets.
+      - name: Update rolling "latest" AppImage
+        env:
+          TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITEA_TOKEN }}
+          API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+        run: bash .gitea/scripts/update-latest.sh