fix(ci): test triggering ref on PRs, unify token secret, harden JSON parsing

- ci.yml: check out the PR head (or push SHA) instead of always cloning
  main; PR checks now test the actual diff. Drop http.sslVerify=false.
  Publish to the package registry only on push events.
- preview.yml/release.yml: use GITEATOKEN (GITEA_TOKEN is reserved by
  Gitea, so these token steps were silently broken).
- deploy-chrome.yml/release.yml: parse JSON with node instead of
  python3 (not installed in the container) and grep; fail loudly
  instead of swallowing errors with 2>/dev/null.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/preview.yml

@@ -43,6 +43,6 @@ jobs:
         run: |
           PR_NUM=${{ gitea.event.pull_request.number }}
           curl -s -X POST "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/issues/${PR_NUM}/comments" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -H "Content-Type: application/json" \
             -d "{\"body\": \"## ⚡ LexAI Preview Build Ready\n\n✅ Tests passed\n✅ Build successful\n✅ TypeScript clean\n\nCommit: \`${{ gitea.sha }}\`\"}"