fix(ci): test triggering ref on PRs, unify token secret, harden JSON parsing

- ci.yml: check out the PR head (or push SHA) instead of always cloning
  main; PR checks now test the actual diff. Drop http.sslVerify=false.
  Publish to the package registry only on push events.
- preview.yml/release.yml: use GITEATOKEN (GITEA_TOKEN is reserved by
  Gitea, so these token steps were silently broken).
- deploy-chrome.yml/release.yml: parse JSON with node instead of
  python3 (not installed in the container) and grep; fail loudly
  instead of swallowing errors with 2>/dev/null.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           VERSION=${{ gitea.ref_name }}
           curl -s -X POST "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -H "Content-Type: application/json" \
             -d "{
               \"tag_name\": \"${VERSION}\",
@@ -50,14 +50,15 @@ jobs:
               \"prerelease\": false
             }" > release.json
           cat release.json
-          echo "RELEASE_ID=$(cat release.json | grep -o '\"id\":[0-9]*' | head -1 | cut -d: -f2)" >> $GITHUB_ENV
+          RELEASE_ID=$(node -e "const r=require('./release.json'); if(!r.id) { console.error('No release id in response:', JSON.stringify(r)); process.exit(1); } console.log(r.id)")
+          echo "RELEASE_ID=${RELEASE_ID}" >> $GITHUB_ENV
 
       - name: Upload ZIP to Release
         run: |
           VERSION=${{ gitea.ref_name }}
           RELEASE_ID=${{ env.RELEASE_ID }}
           curl -s -X POST "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -F "attachment=@lexai-chrome-mv3-${VERSION}.zip"
           echo "✅ Release ${VERSION} published!"
 
@@ -65,7 +66,7 @@ jobs:
         run: |
           VERSION=${{ gitea.ref_name }}
           curl -s -X PUT "https://git.juankibin.space/api/packages/kibin/generic/lexai-extension/${VERSION}/lexai-chrome-mv3-${VERSION}.zip" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -T lexai-chrome-mv3-${VERSION}.zip
           echo "✅ Published lexai-chrome-mv3-${VERSION}.zip to package registry"
           echo "📦 Download: https://git.juankibin.space/kibin/LexAI/packages"