fix: xvfb for headless CI, curl -f + set -euo pipefail in release, fix PAM paths in README

.gitea/workflows/release.yml

@@ -42,20 +42,25 @@ jobs:
           tar czf ahfail-linux-x86_64.tar.gz -C dist .
 
       - name: Create Gitea release and upload asset
+        # Requires a GITEA_TOKEN secret with write:repository scope.
+        # Create it in repo Settings → Secrets.
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           GITEA_URL: https://gitea.weircon.dk
           REPO: agw/gtk-ahfail
           TAG: ${{ github.ref_name }}
         run: |
-          RELEASE_ID=$(curl -s -X POST \
+          set -euo pipefail
+          RELEASE_ID=$(curl -f -X POST \
             "${GITEA_URL}/api/v1/repos/${REPO}/releases" \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -H "Content-Type: application/json" \
             -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"draft\":false}" \
             | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
 
-          curl -s -X POST \
+          [ -n "${RELEASE_ID}" ] || { echo "ERROR: empty RELEASE_ID from API"; exit 1; }
+
+          curl -f -X POST \
             "${GITEA_URL}/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets" \
             -H "Authorization: token ${GITEA_TOKEN}" \
             -F "attachment=@ahfail-linux-x86_64.tar.gz"