Public release checklist

Complete these items while the repository is still private:

Rotate the bearer token that was previously embedded in the application and deployment configuration.
Rewrite Git history to remove the old bearer token and application PIN, and replace the original commit author email with a noreply identity.
Configure the Gitea Actions variables and secrets documented in README.md, and verify the image build in a clean checkout.
Review repository-adjacent data that is not in Git: issues, pull requests, releases, packages, wiki pages, webhooks, deploy keys, collaborators, and Actions logs/artifacts.
Run a credential scanner against the rewritten history and inspect the final tracked-file list before changing visibility.
Enable appropriate branch protection and decide whether public issue and pull-request creation should be enabled.

Changing repository visibility is intentionally not part of this checklist's automated preparation.