Build Linux release artifacts in Gitea

docs/PROJECT-STRUCTURE.md

@@ -35,6 +35,8 @@ S:\Game Hacking\Eushully\Himegari\           ← workspace root (three siblings)
     ├── .editorconfig / .gitattributes        UTF-8, indentation, text/EOL, and binary-file policy;
     │                                         tracked source and generated references use canonical LF
     ├── .gitea/workflows/core-validation.yml  read-only Ubuntu source-only core gate for the private Gitea remote
+    ├── .gitea/workflows/linux-release-build.yml
+    │                                       pinned Linux export/package/smoke artifact job; no release publication
     ├── run-godot.ps1 / run-godot.cmd         tracked development launcher + Windows wrapper;
     │                                          resolves Godot/game-root from parameters, environment,
     │                                          PATH, and the conventional sibling install

docs/platform-portability.md

@@ -52,6 +52,15 @@ native loading without weakening the separate installed-game/font/render/audio a
 20.04 WSL proof passed using isolated Python 3.11/.NET 8.0.408 toolchains; the eventual Gitea job can provide those
 through its existing setup actions.
 
+The hosted artifact wrapper is now `.gitea/workflows/linux-release-build.yml`. It invokes that exact local
+command on `develop`, manual dispatch, and `v*` tags while the independent source-only core workflow remains the
+fast integration gate. The cache key is derived from both immutable dependency manifests and has no broad restore
+prefix; cached archives/templates are still size/hash checked by their owning bootstrap before use. A successful
+job retains the archive, external build/checksum manifests, and smoke log for 30 days. It has only read access to
+repository contents and does not use private data, secrets, registry credentials, or release-write permission.
+The first hosted execution remains the acceptance gate for runner image dependencies and cache/artifact action
+behavior; release publication is intentionally deferred until that artifact run succeeds.
+
 ## Dependency inventory
 
 | Area | Current dependency | Runtime impact | Portability status / future action |

docs/remake-architecture-and-roadmap.md

@@ -999,6 +999,16 @@ do not mix mechanical moves with semantic changes.
    calls this command on `develop`, manual dispatch, and release tags, caches immutable downloads/toolchains, and
    uploads the archive; release publication remains a later, tag-only promotion step after hosted artifact proof.
 
+   **Gitea Linux artifact workflow (2026-08-03):** the second CI/CD slice adds a separate read-only
+   `.gitea/workflows/linux-release-build.yml` job for `develop`, manual dispatch, and `v*` tags. It provisions
+   the pinned Python/.NET toolchain, restores only manifest-keyed Godot/FFmpeg archives plus the verified Linux
+   template, calls the same locally accepted build command, and uploads the archive with its external build info,
+   checksum ledger, and smoke log. Cache entries have no broad fallback and remain subject to the bootstrap's
+   size/SHA checks. The workflow has no game corpus, secrets, registry login, or release-write authority; tags
+   still produce ordinary retained workflow artifacts. The immediate gate is the first hosted build on this
+   server. If it passes, the next bounded slice can promote an already-verified tag artifact to a Gitea release
+   without rebuilding it; if it fails, fix only the observed runner/action dependency before adding publication.
+
 **Not cleanup targets:** generated `build/` output, the two intentional solution files, historical
 `docs/superpowers/` plans/specifications, and fidelity-specific complexity that is directly covered by the
 native ABI. Reorganization is successful when ownership and reproduction become clearer, not when the raw

docs/tools-reference.md

@@ -47,6 +47,16 @@ and the first actual Linux/Gitea core run succeeded on 2026-08-03 before the lat
 its tree-equivalent rewritten commit is `524ea74`. The hosted gate also succeeded on the sanitized lineage at
 `d673652` on 2026-08-03.
 
+The artifact wrapper is `.gitea/workflows/linux-release-build.yml`. It runs independently from the fast core
+gate on `develop` pushes, manual dispatch, and `v*` tag pushes. The job uses the same Python 3.11 and
+`global.json` .NET setup actions, then calls `./tools/build-linux-x64.sh` unchanged. `actions/cache@v4` retains
+only the two hash-verified dependency archives and the independently hash-verified Linux release template; its
+key is the combined Godot/FFmpeg manifest hash and deliberately has no prefix fallback. Successful runs upload
+the `.tar.gz`, unpacked `BUILD-INFO.json`/`SHA256SUMS`, and packaged-runtime smoke log for 30 days. Failed runs
+retain any smoke/validation evidence for seven days. The workflow has read-only repository permission, no
+secrets or private game corpus, and no release/package publication authority; a tag currently changes only the
+build trigger, not the artifact's destination.
+
 ## Optional local binary tools
 
 `bin/` is an ignored machine-local tool directory, not a source or artifact distribution directory. A local