Public downloads: the installer and the updater come from Gitea releases, no token

REQUIRE_SIGNIN_VIEW is off and mitchell/hamlab is public, so anyone can clone it or pull
a release. The other five repos are individually private and 404 to anonymous. Gitea
resolves releases/download/latest/<asset>, so the install one-liner and HAMLAB_URL point
at the newest release and never need changing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -398,6 +398,17 @@ something long in one, switch away and back, refresh — it's all still there.
   **not** part of `make deploy`, because deploy pushes this build to the machines this hub
   owns while publishing offers it to every install anywhere, and one tag per deploy would
   be noise. Re-publishing a version needs `--force`.
+  **Public since 2026-09-23**, at Mitchell's instruction and after the trade was put to him
+  twice: Gitea's instance-wide `REQUIRE_SIGNIN_VIEW` is off and `mitchell/hamlab` is marked
+  public, so anyone can browse it, clone it and download a release with no account. The
+  other five repos there are each marked private and are invisible — an anonymous request
+  for one is a 404, not a login prompt — registration is still disabled, and new repos
+  still default to private. No token is needed by anything any more (the read-only one was
+  revoked; only `hamlab-publish`, which creates releases, remains). Gitea resolves
+  `releases/download/latest/<asset>`, so `install.sh` and `HAMLAB_URL` now point straight
+  at the newest release and never need changing; the rolling copy on
+  `hamlab-demo.bigham.dev` stays as a mirror. What is public is the source, the history,
+  `BUGS.md` and this file — which describes the lab and names the console's hostname.
 - **Auth hardening** — WebAuthn passkeys (phone Face ID), TOTP fallback, optional NPM
   access list restricting to WireGuard/LAN.
 - **Files tab** — **shipped 2026-09-18** (`internal/files`, `Files.tsx`): browse from
@@ -426,28 +437,6 @@ something long in one, switch away and back, refresh — it's all still there.
 
 ## To do
 
-- **Somewhere public to download from** — asked for 2026-09-22, half done. The **updater**
-  shipped 2026-09-23 (above) and reads releases from Gitea, but `git.bigham.dev` runs with
-  `REQUIRE_SIGNIN_VIEW=true`, so those releases are reachable only with a token. That is
-  fine for this fleet — each machine carries a read-only `read:repository` token — and no
-  use at all to a stranger running the `install.sh` one-liner, who still gets the rolling
-  copy on `hamlab-demo.bigham.dev`. What is left is deciding where a public download
-  actually lives:
-  - **Lower the wall on Gitea.** `REQUIRE_SIGNIN_VIEW=false` and per-repo visibility does
-    the rest: every repo there is private and stays hidden, and only a repo marked public
-    is visible. That is how Gitea is meant to be configured, and it is the one change that
-    makes "releases on my Gitea" literally true. It is an instance-wide posture change on
-    a public hostname, so it is Mitchell's call — the same trade was declined once before
-    (`docs/docker.md`, the demo site's `install.sh` is hosted outside Gitea for exactly
-    this reason).
-  - **Or keep the wall and keep the demo site** as the public face: `make publish` already
-    writes the rolling `dl/` directory there, and a generated index page (version, built
-    when, a row per architecture with size and checksum, the one-line install, and that
-    the binaries are unsigned and served from his own box) would finish the "page" half
-    without touching Gitea at all.
-  - Either way the release notes and version history live on Gitea, and the updater does
-    not care which of the two it is pointed at.
-
 - **Deprecate copyparty** — asked for 2026-09-23, not started. `copyparty` on `grid`
   (`copyparty.service`, `:3923`, `/etc/copyparty.conf`, serving all of `/tank` as user
   `core` with one account behind NPM) overlaps the **Files** tab almost entirely. The aim