ci: gate optional release steps on env vars, not the secrets context

GitHub Actions rejects the secrets context in if: conditions; the
workflow failed validation on push. Mirror build.yml's pattern of
copying the secret into step env and gating on that.

.github/workflows/windows-gitea-release.yml

@@ -73,7 +73,8 @@ jobs:
       - name: Upload symbols to bugs.plezy.app
         # Only when this fork has been given the admin token (the production
         # token lives on edde746/plezy, which is not the build bridge).
-        if: secrets.BUGS_ADMIN_TOKEN != ''
+        # The secrets context is unavailable in `if`, so gate on the env copy.
+        if: env.BUGS_ADMIN_TOKEN != ''
         shell: pwsh
         env:
           BUGS_ADMIN_TOKEN: ${{ secrets.BUGS_ADMIN_TOKEN }}
@@ -92,7 +93,7 @@ jobs:
         run: .\windows\build-installer.ps1 -X64BuildDir "build\windows\x64\runner\Release" -Version "${{ steps.version.outputs.version }}"
 
       - name: Sign installer for WinSparkle (EdDSA)
-        if: secrets.SPARKLE_PRIVATE_KEY != ''
+        if: env.SPARKLE_PRIVATE_KEY != ''
         env:
           SPARKLE_PRIVATE_KEY: ${{ secrets.SPARKLE_PRIVATE_KEY }}
         shell: pwsh