feat: OTA TLS cert verification + CI release pipeline

Wire ESP-IDF's built-in 150-CA root bundle to the OTA HTTP client
so HTTPS OTA verifies server certificates. Pin bundle config in
sdkconfig.defaults. Replace dead artifact-copy step with Gitea
release creation on tag push. Bump CI container to IDF v5.5.

.gitea/workflows/lint.yml

@@ -14,7 +14,7 @@ jobs:
     needs: [cppcheck, flawfinder, gitleaks]
     runs-on: anvil
     container:
-      image: docker.io/espressif/idf:v5.3
+      image: docker.io/espressif/idf:v5.5
       volumes:
         - /var/cache/ccache:/ccache
     env:
@@ -90,15 +90,33 @@ jobs:
           cd get-started/csi_recv_router
           idf.py size-components 2>/dev/null | head -30
 
-      - name: Upload firmware artifact
+      - name: Create release
+        if: startsWith(github.ref, 'refs/tags/v')
         run: |
-          mkdir -p /tmp/artifacts
-          cp get-started/csi_recv_router/build/csi_recv_router.bin /tmp/artifacts/
-          cp get-started/csi_recv_router/build/bootloader/bootloader.bin /tmp/artifacts/
-          cp get-started/csi_recv_router/build/partition_table/partition-table.bin /tmp/artifacts/
-          cp get-started/csi_recv_router/build/ota_data_initial.bin /tmp/artifacts/
-          echo "Artifacts ready in /tmp/artifacts"
-          ls -la /tmp/artifacts/
+          BIN="get-started/csi_recv_router/build/csi_recv_router.bin"
+          TAG="${{ github.ref_name }}"
+          API="https://git.mymx.me/api/v1/repos/${{ github.repository }}"
+          TOKEN="${{ github.token }}"
+          SIZE=$(stat -c%s "$BIN")
+
+          RELEASE_ID=$(curl -sS -f -X POST "$API/releases" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"tag_name\": \"$TAG\",
+              \"name\": \"$TAG\",
+              \"body\": \"Firmware $TAG — $((SIZE / 1024)) KB\"
+            }" | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")
+
+          echo "Release $RELEASE_ID created for $TAG"
+
+          curl -sS -f -X POST \
+            "$API/releases/$RELEASE_ID/assets?name=csi_recv_router.bin" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @"$BIN"
+
+          echo "Uploaded csi_recv_router.bin ($((SIZE / 1024)) KB)"
 
   cppcheck:
     name: C/C++ Static Analysis