Publish releases to kw/nolimit-discounts-dist and point the header there

The family shape is source private, releases in a separate public repo so a
shop can fetch an update without credentials and without the source being
readable. This plugin was the only one still serving its own update feed out of
the repository that holds ci/, docs/ and tests/.

kw/nolimit-discounts-dist created (public, zips only). RELEASE_REPO in
ci/plugin.conf now names it, and ci/publish-release.sh honours it over
GITHUB_REPOSITORY — falling back to the running repo, which is what a plugin
without a split still wants.

🔴 The "Update URI:" header moves in the SAME commit as the publishing target,
and ci/static.sh now fails when the two disagree. The header is what every
installed copy polls; if it names a repository nothing is published to any
more, the shop stops being offered updates and nothing announces it, because
latest_release() simply returns false. That is the same failure as a privacy
page standing still while the code moves, and the check is what makes it
impossible to forget.

Proven red before being believed: pointing RELEASE_REPO at another repository
fails with both sides named. RELEASE_REPO is required by ci_load_conf, because
an unset value would turn the comparison into a no-op and restore exactly the
bug it prevents.

Not done here, and it is the blocker for actually cutting a release: publishing
to another repository needs a token with write access to it. The job token only
covers the repo it runs in, so this needs a cross-repo PAT in the repository
secrets, and that is Kristian's to add.

Also not done, deliberately: the source repo stays public for now. Making it
private before the dist repo has releases would break the feed for the copy
installed on the live shop, whose header still points at the old address.
1.4.6 and earlier keep working through Gitea's rename redirect - measured, the
old name still answers 200 - and that redirect is the only thing holding them
up, so it must not be removed until a build carrying the new header has
propagated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci/plugin.conf

@@ -51,3 +51,18 @@ MIN_SHIPPED_PHP_FILES=5
 # Set to 0 for a plugin with no translatable strings: the check then warns
 # instead of failing, so zero is never silent either way.
 MIN_TRANSLATION_CALLS=60
+
+# Where releases are published, when that is not the repository running the
+# workflow. The source repo is kw/nolimit-discounts; the plugin's update feed
+# is a separate PUBLIC repo holding built zips only, so a shop can fetch
+# updates without credentials and without the source being readable.
+#
+# 🔴 This and the "Update URI:" header in the plugin file must name the same
+# repository. ci/static.sh fails when they disagree — a feed that moves while
+# the header stands still is how every installed copy silently stops receiving
+# updates, and nothing announces it because latest_release() just returns false.
+#
+# Publishing here needs a token with write access to that OTHER repository. The
+# job token only covers the repo it runs in, so this is a cross-repo PAT and
+# Kristian's to add.
+RELEASE_REPO=kw/nolimit-discounts-dist