Collapse the matrix to one linear job on the amd64 :host runner: test
once, then build x86_64 natively and aarch64 by cross-compilation, then
publish both to a Forgejo release. Authenticate the upload with a real
write token (RELEASE_TOKEN, the carvers-ci bot) -- Forgejo's auto
GITHUB_TOKEN cannot upload release attachments. prerelease is a string
input, not boolean, so its value survives an API workflow_dispatch.
