feat(release): fold distribution back into the source repo

The separate J3vb/OwnCord-releases repo existed only because this repo was
private: it carried the AGPL source snapshot and provided a publicly-readable
update feed. Once this repo is public both roles collapse into its own Releases
page, so the mirror is pure redundancy.

- Server/config/config.go: github.repo default OwnCord-releases -> OwnCord.
  This one default drives both the server self-update and the client
  auto-update chain (tauri.conf.json updater.endpoints is empty, so the client
  resolves through the server). No test pinned the old value.
- release.yml: drop the mirror step and its RELEASES_REPO_TOKEN guard, whose
  AGPL/private-repo premise no longer holds. The existing Create GitHub Release
  step is now the sole publish target. All 31 SHA pins verified intact.
- Repoint the README badge/download link, both SECURITY.md links, the
  server-configuration table and sample, the system-overview diagram node and
  the CHANGELOG note. SECURITY.md's advisory link is the load-bearing one: left
  alone it would 404 once the mirror repo is deleted.
- README: Go 1.25+ -> 1.26+ (badge and prerequisite) to match the toolchain
  actually required.

Deleting the mirror repo loses nothing: both repos' v1.1.0-alpha.2 carry
byte-identical asset sets, signatures and update manifest included.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -421,6 +421,11 @@ jobs:
         shell: bash
         run: npx changelogen --output CHANGELOG.md
 
+      # Sole publish target. This repo is public, so its own Releases page both
+      # satisfies AGPL source availability (via the owncord-src snapshot below)
+      # and serves as the publicly-readable feed that deployed servers and
+      # clients poll for updates. The former mirror step to a separate public
+      # releases repo existed only to work around this repo being private.
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -430,29 +435,3 @@ jobs:
           gh release create "${{ github.ref_name }}" \
             --notes-file CHANGELOG.md \
             "${assets[@]}"
-
-      # The public releases repo is what deployed servers and clients poll for
-      # updates, and it carries the AGPL source snapshot while the source repo
-      # is private. Publishing there must never be skipped silently once the
-      # source repo is private.
-      - name: Publish to public releases repo
-        shell: bash
-        env:
-          RELEASES_TOKEN: ${{ secrets.RELEASES_REPO_TOKEN }}
-          SOURCE_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          if [ -z "$RELEASES_TOKEN" ]; then
-            PRIVATE=$(GH_TOKEN="$SOURCE_REPO_TOKEN" gh api "repos/$GITHUB_REPOSITORY" --jq .private)
-            if [ "$PRIVATE" = "true" ]; then
-              echo "::error::Source repo is private and RELEASES_REPO_TOKEN is unset — binaries would ship with no public source or update feed (AGPL violation, broken updater)."
-              exit 1
-            fi
-            echo "::warning::RELEASES_REPO_TOKEN not set — skipping publish to J3vb/OwnCord-releases."
-            exit 0
-          fi
-          mapfile -t assets < <(find windows linux -type f)
-          assets+=(checksums.sha256 owncord-src-*.tar.gz)
-          GH_TOKEN="$RELEASES_TOKEN" gh release create "${{ github.ref_name }}" \
-            --repo J3vb/OwnCord-releases \
-            --notes-file CHANGELOG.md \
-            "${assets[@]}"