ci: move tag mirror workflow into .github/workflows

Gitea's workflow discovery scans the first existing directory in
['.gitea/workflows', '.github/workflows'] and ignores the rest, so a
.gitea/workflows directory would silently shadow ci.yml and every other
workflow on this repo. The mirror workflow now lives next to the others
with a server_url guard so it only runs on Gitea.

.github/workflows/mirror-tags-to-github.yml

@@ -3,14 +3,21 @@ name: Mirror release tags to GitHub build bridge
 # Gitea is the source of truth for releases, but this instance has no Windows
 # runner (only ubuntu-latest on the homeserver), and Flutter Windows builds
 # require a Windows host. So when a tag is pushed here, this workflow mirrors it
-# to the public GitHub fork yorickr/plezy, whose only active workflow
+# to the public GitHub fork yorickr/plezy, whose windows-gitea-release workflow
-# (.github/workflows/windows-gitea-release.yml) builds the Windows release on
+# builds the Windows release on GitHub-hosted runners and publishes the
-# GitHub-hosted runners and publishes the artifacts back to this repo's Gitea
+# artifacts back to this repo's Gitea release for the same tag.
-# release for the same tag.
+#
+# This file lives in .github/workflows (not .gitea/workflows) on purpose:
+# Gitea's workflow discovery uses the first existing directory in
+# [".gitea/workflows", ".github/workflows"], so a .gitea/workflows directory
+# would shadow every other workflow in this repo (ci.yml et al.) on Gitea.
 #
 # The write path uses an SSH deploy key (secret RELEASE_PUSH_KEY) that only has
 # access to the fork. ssh.github.com:443 is used because the homeserver
 # demonstrably reaches GitHub over 443, and it avoids depending on outbound 22.
+#
+# The job-level guard keeps this from running on GitHub (the fork would
+# otherwise attempt it on every mirrored tag and fail on the missing secret).
 
 on:
   push:
@@ -26,6 +33,7 @@ on:
 jobs:
   mirror-tag:
     name: Mirror tag to GitHub
+    if: github.server_url != 'https://github.com'
     runs-on: ubuntu-latest
     permissions:
       contents: read