chore(ops): version the release scripts

They existed only in /opt/ops on the VPS — no history, no backup. Rebuilding
that machine would have taken the whole publishing process with it, including
the Android signing flow written today.

/opt/ops now symlinks here so there is one copy rather than two that drift.
No secrets move: the scripts read tokens and the signing key from paths under
/root that stay on the VPS.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ops/release-desktop.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Espelha o fork no GitHub e dispara a compilacao dos instaladores.
+#
+# O GitHub e usado apenas como maquina de build: ele fornece runners Windows
+# prontos, e o modulo nativo do audio (WASAPI) so compila la. O Gitea continua
+# sendo o repositorio principal.
+set -euo pipefail
+
+REPO=${REPO:-/opt/backspace}
+TAG=${1:-}
+cd "$REPO"
+
+if [ -z "$TAG" ]; then
+  echo "uso: $0 vX.Y.Z" >&2
+  exit 2
+fi
+
+# `ssh -T git@github.com` always exits 1 (GitHub refuses shell access), and
+# under `pipefail` that status wins over grep's — so piping straight into the
+# `if` reported failure even on a working key. Capture, then test.
+SSH_PROBE="$(ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -T git@github.com 2>&1 || true)"
+if ! printf '%s' "$SSH_PROBE" | grep -q "successfully authenticated"; then
+  echo "GitHub ainda nao aceita a chave desta VPS." >&2
+  echo "Adicione esta chave em https://github.com/settings/keys :" >&2
+  cat ~/.ssh/id_ed25519.pub >&2
+  exit 1
+fi
+
+echo "==> Espelhando main no GitHub"
+git push github main
+
+echo "==> Marcando $TAG (e a tag que dispara o workflow release.yml)"
+git tag -f "$TAG"
+git push -f github "$TAG"
+
+echo
+echo "Compilacao disparada. Acompanhe em:"
+echo "  https://github.com/syncwrld/resenhacord/actions"
+echo "Os instaladores aparecem em Releases quando terminar (~15 min)."