Releases come from dl.redoal.com, and the site runs portal 0.6.20

The front door's releases card read the private repo's Gitea releases
with its link nulled, since those 404 for visitors. It now reads the
public manifest redoal's release job writes to dl.redoal.com, which
portal renders as a download card with this device's file first. The
pins move from v0.5.2 to v0.6.20 for both the instance and the lint;
the content lints clean on it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -18,7 +18,7 @@ on:
       - .gitea/workflows/deploy.yml
 
 env:
-  PORTAL_RELEASE: v0.5.2
+  PORTAL_RELEASE: v0.6.20
   INSTANCE: redoal-portal
 
 jobs:

.gitea/workflows/lint-and-reload.yml

@@ -20,7 +20,7 @@ jobs:
       # this site runs (PORTAL_RELEASE in deploy.yml).
       - name: Lint questions
         env:
-          IRIS_RELEASE: v0.5.2
+          IRIS_RELEASE: v0.6.20
         run: |
           # The checkout is on a noexec mount for this runner; the cargo
           # target dir is where it may run what it fetched.

questions/index.yaml

@@ -132,31 +132,17 @@ alternatives:
         description: Start exploring by running one of our applications.
         icon: lucide:package
         resource:
+          # The public manifest redoal's release job writes to
+          # dl.redoal.com (the repo is private; its own release assets
+          # 404 for visitors). Portal renders a manifest of this shape as
+          # one download card: the newest version, this device's file
+          # first, the Arch repo lines and TestFlight folded with the
+          # rest (content-reference, "A releases manifest").
           source:
-            kind: gitea_releases
-            owner: redoal
-            repo: redoal
+            kind: url
+            url: https://dl.redoal.com/releases.json
           public: true
           empty: Nothing released yet — the first cut lands here.
-          # Only the newest cut. A card per release made this section
-          # grow forever, and the one a visitor should run is the latest
-          # — the rest are history, not an invitation.
-          #
-          # `limit` is the portal mechanism for this (uhhm/portal
-          # 22d086f, content-reference "A resource"), and this site is
-          # pinned to PORTAL_RELEASE v0.5.2, which predates it. So the
-          # `.[0]` below is what actually does the work today and
-          # `limit: 1` is the same intent declared for when the pin
-          # moves forward; at that point `.[0]` goes back to `.[]` and
-          # the field takes over.
-          limit: 1
-          # url pinned to null while the repo is private - a private
-          # release's html_url 404s for anonymous visitors, and the
-          # card renders an unlinked heading instead (same lesson as
-          # uhhm/questions 9b7162f).
-          jq: >
-            .[0] | {name: .name, description: .body, tag: .tag_name,
-            published: .published_at, url: null}
       - name: Test the iPhone app
         description: >
           The desktop releases above run free, no sign-up. The iPhone