Take the tarball host address from a repository variable

The upload steps named the web host by its internal address. It now comes
from the TARBALLZ_TARGET repository variable, so the public workflow carries
no infrastructure details.

Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9

.gitea/workflows/aur-publish.yml

@@ -116,7 +116,7 @@ jobs:
           printf '%s\n' "$TARBALLZ_SSH_KEY" > ~/.ssh/tarballz
           chmod 600 ~/.ssh/tarballz
           ssh -i ~/.ssh/tarballz -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 < aur-pkg/PKGBUILD
+            "${{ vars.TARBALLZ_TARGET }}" < aur-pkg/PKGBUILD
 
   # ahfail-bin: the same release, prebuilt. The binary is built from the TAG
   # (also when this runs by hand from master), staged as a `meson install` tree,
@@ -186,7 +186,7 @@ jobs:
           # Forced command on the web host: this key may only write ahfail-*.tar.*
           # and ahfail-bin.PKGBUILD, and keeps the newest three tarballs.
           ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
+            "${{ vars.TARBALLZ_TARGET }}" "tarball ${{ steps.tarball.outputs.name }}" < "${{ steps.tarball.outputs.name }}"
 
       - name: Verify the public URL serves the same bytes
         run: |
@@ -244,4 +244,4 @@ jobs:
         continue-on-error: true
         run: |
           ssh -i ~/.ssh/tarballz-bin -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new \
-            root@192.168.10.148 < aur-bin-pkg/PKGBUILD
+            "${{ vars.TARBALLZ_TARGET }}" < aur-bin-pkg/PKGBUILD