b8e9b65995
curl drops the Authorization header when -L follows Gitea's 308 redirect from http server_url to https, so the API replied 'token is required' and publish failed with no release id. Add --location-trusted to every publish curl.