Release: single build+release job (Gitea has no artifacts API); fakeroot for deb

- upload-artifact@v4+ fails on Gitea/act_runner (GHESNotSupportedError —
  the GitHub artifacts API is not implemented), so merge the android,
  desktop and release jobs into one: build APK+AAB + desktop zip/deb,
  then create the release and upload attachments from the workspace
- jpackage --type deb needs fakeroot, which the runner image lacks —
  install it via apt
- sync CI-SETUP.md §3 with the restructured workflow

.gitea/workflows/release.yml

@@ -77,8 +77,11 @@ jobs:
         working-directory: app
         run: ./gradlew :shared:testAndroidHostTest :shared:desktopTest
 
-  android:
-    name: Build Android APK
+  # Gitea/act_runner does not implement the GitHub artifacts API
+  # (upload-artifact@v4+ fails with GHESNotSupportedError), so the builds and
+  # the release creation happen in ONE job — no artifact handoff between jobs.
+  release:
+    name: Build + create Gitea release
     runs-on: ubuntu-latest
     needs: [gateway, kotlin]
     steps:
@@ -108,6 +111,11 @@ jobs:
           echo "ANDROID_HOME=$ANDROID_HOME" >> "$GITHUB_ENV"
           echo "sdk.dir=$ANDROID_HOME" > app/local.properties
 
+      # jpackage --type deb shells out to fakeroot, which the runner image
+      # does not ship.
+      - name: Install fakeroot (for jpackage --type deb)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq fakeroot
+
       - name: Restore release keystore (from Gitea secrets)
         env:
           KS_B64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
@@ -142,33 +150,10 @@ jobs:
               "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.aab"
           fi
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: android
-          path: |
-            iris-android-*.apk
-            iris-android-*.aab
-
-  desktop:
-    name: Build desktop (Linux, jpackage)
-    runs-on: ubuntu-latest
-    needs: [gateway, kotlin]
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: "21"
-
-      - name: Strip local JDK pin
-        run: sed -i '/^org\.gradle\.java\.home/d' app/gradle.properties
-
-      # jpackage cannot cross-compile: this job only produces Linux packages.
-      # When a Windows / macOS runner exists later, copy this job, change
-      # runs-on, and drop the -x64-linux suffix (jpackage picks the native
-      # type: msi on Windows, dmg on macOS).
-      - name: Build app-image + deb
+      # jpackage cannot cross-compile: this only produces Linux packages.
+      # When a Windows / macOS runner exists later, add a second build job
+      # for it (jpackage picks the native type: msi on Windows, dmg on macOS).
+      - name: Build desktop app-image + deb
         run: |
           VERSION=$(jq -r '.inputs.version' "$GITHUB_EVENT_PATH")
           cd app
@@ -176,27 +161,11 @@ jobs:
           ./gradlew :desktopApp:jpackage -PappVersion="$VERSION"
           (cd desktopApp/build/jpackage && zip -qr \
             "$GITHUB_WORKSPACE/iris-desktop-linux-x64-v$VERSION.zip" iris)
-          # .deb package (dpkg-deb ships with Ubuntu).
+          # .deb package (dpkg-deb ships with Ubuntu; fakeroot installed above).
           ./gradlew :desktopApp:jpackage -PjpackageType=deb -PappVersion="$VERSION"
           cp desktopApp/build/jpackage/*.deb \
             "$GITHUB_WORKSPACE/iris-desktop-linux-x64-v$VERSION.deb"
 
-      - uses: actions/upload-artifact@v4
-        with:
-          name: desktop
-          path: |
-            iris-desktop-linux-x64-*.zip
-            iris-desktop-linux-x64-*.deb
-
-  release:
-    name: Create Gitea release
-    runs-on: ubuntu-latest
-    needs: [android, desktop]
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          path: artifacts
-
       - name: Create release + upload artifacts
         env:
           # Optional: create a personal access token (scope: Releases: write)
@@ -228,10 +197,10 @@ jobs:
             | jq -r .id)
           echo "Created release $TAG (id $RELEASE_ID)"
 
-          for f in artifacts/*/*; do
+          for f in "$GITHUB_WORKSPACE"/iris-android-v* "$GITHUB_WORKSPACE"/iris-desktop-*; do
             [ -f "$f" ] || continue
             echo "Uploading $(basename "$f")"
             curl -sf -X POST -H "$AUTH" -F "attachment=@$f" \
               "$API/releases/$RELEASE_ID/attachments" > /dev/null
           done
-          echo "Done: $SERVER/$REPO/releases/tag/$TAG"
+          echo "Done: $SERVER/$REPO/releases/tag/$TAG"