GitHub Actions rejects the secrets context in if: conditions; the
workflow failed validation on push. Mirror build.yml's pattern of
copying the secret into step env and gating on that.
Gitea has no Windows runner, so release tags pushed to this repo are
mirrored to the public GitHub fork yorickr/plezy (SSH deploy key over
ssh.github.com:443). The fork's windows-gitea-release workflow builds
the Windows x64 installer + portable on GitHub-hosted runners and
publishes them to the Gitea release for the same tag.