fix(ci): test triggering ref on PRs, unify token secret, harden JSON parsing

- ci.yml: check out the PR head (or push SHA) instead of always cloning
  main; PR checks now test the actual diff. Drop http.sslVerify=false.
  Publish to the package registry only on push events.
- preview.yml/release.yml: use GITEATOKEN (GITEA_TOKEN is reserved by
  Gitea, so these token steps were silently broken).
- deploy-chrome.yml/release.yml: parse JSON with node instead of
  python3 (not installed in the container) and grep; fail loudly
  instead of swallowing errors with 2>/dev/null.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/deploy-chrome.yml

@@ -41,7 +41,7 @@ jobs:
           VERSION=${{ gitea.ref_name || 'manual' }}
           ZIPFILE="$(pwd)/lexai-chrome-mv3-${VERSION}.zip"
           # Verify manifest exists and check version
-          cat .output/chrome-mv3/manifest.json | python3 -c "import json,sys; m=json.load(sys.stdin); print('Manifest version:', m['version'])"
+          node -e "console.log('Manifest version:', require('./.output/chrome-mv3/manifest.json').version)"
           # Zip from inside the chrome-mv3 dir so manifest.json is at root
           cd .output/chrome-mv3 && zip -r "$ZIPFILE" . && cd -
           echo "ZIP_FILE=${ZIPFILE}" >> $GITHUB_ENV
@@ -56,7 +56,7 @@ jobs:
             -d "client_secret=${{ secrets.CWS_CLIENT_SECRET }}" \
             -d "refresh_token=${{ secrets.CWS_REFRESH_TOKEN }}" \
             -d "grant_type=refresh_token")
-          ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['access_token'])" 2>/dev/null)
+          ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | node -e "let s='';process.stdin.on('data',d=>s+=d);process.stdin.on('end',()=>{let d;try{d=JSON.parse(s)}catch(e){console.error('Invalid JSON token response:',s);process.exit(1)};if(!d.access_token){console.error('No access_token in response:',s);process.exit(1)};console.log(d.access_token)})")
           if [ -z "$ACCESS_TOKEN" ]; then
             echo "❌ Failed to get access token. Response: $TOKEN_RESPONSE"
             exit 1
@@ -72,7 +72,7 @@ jobs:
             -H "x-goog-api-version: 2" \
             -T "${{ env.ZIP_FILE }}")
           echo "Upload Response: $UPLOAD_BODY"
-          UPLOAD_STATE=$(echo "$UPLOAD_BODY" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('uploadState',''))" 2>/dev/null)
+          UPLOAD_STATE=$(echo "$UPLOAD_BODY" | node -e "let s='';process.stdin.on('data',d=>s+=d);process.stdin.on('end',()=>{let d;try{d=JSON.parse(s)}catch(e){console.error('Invalid JSON upload response:',s);process.exit(1)};console.log(d.uploadState||'')})")
           echo "Upload state: $UPLOAD_STATE"
           if [ "$UPLOAD_STATE" != "SUCCESS" ]; then
             echo "❌ Upload failed — state: $UPLOAD_STATE"