docs: SSOT for the Gitea CI pipeline and automated alpha releases

docs/ci-and-releases.md documents what happens on a push to main, why Gitea
rather than GitHub (billing-blocked, private repo, and Forgejo ships no hosted
runners), both runners and their prerequisites, the release/manifest layout,
and how to verify a release with the Lane=Live install test.

Its landmine table is the part worth keeping: every row cost a red pipeline —
Node for JS actions, setup-dotnet unmirrored on data.forgejo.org, the
zombie-task timeout caused by run-release-gate.ps1 redirecting child output,
an en-SE runner locale breaking 40 tests on decimal commas, DAT tests missing
their InstalledDat lane tag, parallel-load timing flakes, and the Avalonia
compositor threading failure that must NOT be 'fixed' by de-async-ing the test.

Also records the culture finding: config, parsing and the wire are all
invariant-safe, so US and European installs behave identically; only
diagnostic strings follow the current culture.

Cross-linked from docs/README.md and release-gate.md, which keeps ownership of
the local bounded gate.

docs/README.md

@@ -82,6 +82,8 @@ document in the same change; do not leave both claims standing.
 - [`superpowers/specs/`](superpowers/specs/) and
   [`superpowers/plans/`](superpowers/plans/) are per-slice design and execution
   records. Completed plans remain historical.
+- [`ci-and-releases.md`](ci-and-releases.md) is the SSOT for the Gitea CI
+  pipeline, the self-hosted runners, and how alpha releases are published.
 - [`audit/`](audit/) contains completion and conformance audits.
 - [`reference/ace-commands.md`](reference/ace-commands.md) preserves the local
   ACE server's complete in-game command catalog and points to the authoritative