Workload install without build flags; CI variables and the APK key documented

dotnet workload install refuses -nologo. CLAUDE.md lists every variable and
secret the scripts and workflows read; the README gives the APK
certificate's SHA-256.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

CLAUDE.md

@@ -24,6 +24,33 @@ dotnet publish src/MeWeb.Desktop -c Release -r osx-arm64 --self-contained
 The Android workload installs into the user SDK (`dotnet workload install android`); the system SDK in `/opt/dotnet`
 is root-owned, so CI uses the runner user's own `~/.dotnet` (passolo's `tools/release.sh` pattern).
 
+## Repository, CI and the variables they read
+
+| Name | Where | What |
+|---|---|---|
+| `GITEA_URL` | shell, optional | Gitea base URL for `tools/gitea/*.sh`; default `https://git.thepra.dev` |
+| `GITEA_ORG` | shell, optional | organisation; default `Arasaka` |
+| `GITEA_REPO` | shell, optional | repository for `set_secret.sh`; default `MeWeb` |
+| (git credential store) | `~/.git-credentials` | the only Gitea authentication the scripts use: `git credential fill` for `git.thepra.dev` |
+| `MEWEB_KEYSTORE_B64` | Actions secret | the Android keystore, base64 (`tools/gitea/set_secret.sh`) |
+| `MEWEB_KEYSTORE_PASS` | Actions secret | its password (store and key share it), alias `meweb` |
+| `GITEA_TOKEN` | Actions, automatic | the job token; `release.sh` uses it as `RELEASE_TOKEN` to create the release and attach files |
+| `VERSION`, `COMMIT` | job env | written by `.gitea/scripts/prepare.sh` from `Directory.Build.props` and the commit |
+| `MEWEB_KEYSTORE` | release step | a temporary file in `$RUNNER_TEMP` decoded by `.gitea/scripts/android.sh`, removed on exit |
+
+`build.yml` runs on every push to `master`; `release.yml` on a `v*` tag (publishes the Gitea release) or by hand
+(`publish: false` builds every platform and deploys the server only). Both run on the Arasaka org runner `nuvola`,
+user `gitea-runner`, home `/var/lib/gitea-runner`: `tools/sdk.sh` installs the SDK from `global.json` into its
+`~/.dotnet` (the system SDK in `/opt/dotnet` is older and root-owned), and the JDK, nfpm and the Android SDK are
+cached in `~/.cache/meweb`. There is deliberately no `pull_request` trigger: the runner is the production box.
+
+The server's one-time root setup is `deploy/max/setup.sh` (user `meweb`, `/var/www/meweb.arasaka.software`,
+`/etc/meweb/meweb.env`, the unit, the runner's sudoers line, the certificate, nginx), run on the box through
+`arasaka.software`'s `tools/max/run.sh`.
+
+The Android release key: alias `meweb`, certificate SHA-256
+`5f52cff4f52f4e0b6da6cd044bfceaf78d1d42db24f2470602db7f19cbfdf846`. Never regenerate it.
+
 ## Map
 
 | Path | What |