Add CI checks and a tag-triggered Linux and Windows release

Builds run on the Gitea runner. Windows is cross-compiled from Linux
with cargo-xwin. There is no macOS build because no Mac runner exists.

scripts/ci-setup.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Installs everything the CI jobs need on a Debian/Ubuntu runner.
+# Pass --windows to also install the tools for cross-compiling the Windows build.
+set -euo pipefail
+
+SUDO=$(command -v sudo || true)
+export DEBIAN_FRONTEND=noninteractive
+
+packages=(
+  build-essential curl wget file xdg-utils pkg-config
+  libwebkit2gtk-4.1-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev libxdo-dev
+)
+if [[ "${1:-}" == "--windows" ]]; then
+  packages+=(nsis lld llvm clang)
+fi
+$SUDO apt-get update -q
+$SUDO apt-get install -yq --no-install-recommends "${packages[@]}"
+
+# Rust: not pinned in mise.toml, because mise needs rustup for it.
+if ! command -v cargo >/dev/null; then
+  curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
+fi
+echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+export PATH="$HOME/.cargo/bin:$PATH"
+
+if [[ "${1:-}" == "--windows" ]]; then
+  rustup target add x86_64-pc-windows-msvc
+  cargo install --locked cargo-xwin
+fi
+
+curl -fsSL https://mise.run | MISE_VERSION=v2026.9.1 sh
+echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH"
+export PATH="$HOME/.local/bin:$HOME/.local/share/mise/shims:$PATH"
+mise trust && mise install
+pnpm install --frozen-lockfile