docs: record future distribution and external submission limits

AGENTS.md

@@ -2434,13 +2434,48 @@ Rules:
   The developer APK signature is unchanged; the repo key only signs indexes.
   A backup of the repo keystore/config is in
   `~/.config/skatespots/fdroid-repo/` (mode 600).
-- **F-Droid main/IzzyOnDroid:** still need external review/submission. Source and
+- **F-Droid main/IzzyOnDroid:** **not submitted yet.** Both are external review
-  recipe draft are ready in `distribution/`; F-Droid main would sign with its own
+  processes and require an account/email, which this machine does not own. Do
-  key and cannot install over the Zapstore APK without uninstalling (local data
+  **not** claim they are live. Source, APK, fastlane metadata and
-  loss). Prefer the self-hosted repo/Obtanium until that is explained clearly.
+  `distribution/fdroiddata/org.skatespots.app.yml` are ready. F-Droid main signs
+  with its own key and cannot install over the Zapstore APK without uninstalling
+  (local data loss). Prefer the self-hosted repo/Obtanium until that is
+  explained clearly.
 - **No GitHub required.** Keep Zapstore, Forgejo, the self-hosted F-Droid repo,
   and the static page in sync for each release.
 
+### Future release / distribution checklist
+1. Bump `package.json`; update the top of `release-notes.txt`; run
+   `scripts/release.sh patch --yes --deploy`.
+2. Set `FORGEJO_TOKEN` (or `FORGEJO_PASSWORD`) to upload the APK/checksum to the
+   latest Forgejo release; the helper is `scripts/publish-forgejo.sh`.
+3. **Push source/tags to Forgejo.** The local machine's DNS for
+   `git.skate-spots.org` is intermittent, so the reliable path is: create a git
+   bundle locally, `scp` it to the relay, clone there, and push to
+   `http://127.0.0.1:3000/skatespots/SkateSpots.git` with the host admin
+   credentials. Do not put the password in a committed remote URL.
+4. Add the APK to `/home/ubuntu/fdroid/repo/`, update the F-Droid metadata
+   changelog, run `fdroid update` in `/home/ubuntu/fdroid`, then rsync `repo/`
+   to `/var/www/fdroid/repo/`.
+5. Update `public/download/index.html` with the new version/checksum and deploy
+   the web page.
+6. Verify: latest Forgejo release exposes one `.apk`; static page 200;
+   `https://fdroid.skate-spots.org/repo/index-v2.json` lists the new
+   `versionCode`; Obtanium still resolves the latest release.
+7. Keep Forgejo/F-Droid credentials and the F-Droid repo keystore out of git.
+   Local backups: `~/.config/skatespots/forgejo-admin.txt` and
+   `~/.config/skatespots/fdroid-repo/` (mode 600).
+
+### External submissions (do not fake)
+- **F-Droid main:** blocker is not code — it is a GitLab account, review and
+  F-Droid's signing key. An agent cannot create/verify an external account or
+  pass review. Only start this when the owner supplies an account/email and
+  explicitly accepts the signature/data-loss implications.
+- **IzzyOnDroid:** app listing submissions are handled through their external
+  listing/review process; source and APK are ready. Same account/email blocker.
+- **Obtanium:** there is no store submission. Users add the latest Forgejo
+  release URL (HTML source if needed) or the self-hosted F-Droid repo.
+
 ### Deploy
 - **Web (auto)**: a systemd user timer (`skatespots-deploy.timer`) runs `scripts/auto-deploy.sh` every ~3 min. When `origin/main` changes it builds and runs `netlify deploy --prod --dir=dist`. It deploys **only committed code** (skips if tracked files are modified) and never mutates a dirty tree. **Doc/scripts-only commits are skipped** (matches `AGENTS.md`/`*.md`/`scripts/`/`cvm-server/`/`skills/`) — Netlify bills **15 credits per production deploy**, so don't spend them on non-site changes. One-time setup: `netlify login` + `netlify link`. Logs: `journalctl --user -u skatespots-deploy`. Manual run: `scripts/auto-deploy.sh`.
   - ⚠️ **Deploy throttle (2026-09-28):** production deploys are capped to one per **24h** by default (after a week of 68 deploys ≈ **1,020 credits** — a third of the monthly allowance). Batching a day's commits into one 15-credit deploy is the single biggest credit lever. Override with `SKATESPOTS_DEPLOY_MIN_INTERVAL=<seconds>` (`0` disables); deploy on demand with **`scripts/auto-deploy.sh --force`**. A throttled tick deliberately does **not** record the deployed SHA, so the pending change still deploys on a later tick; a **failed** deploy doesn't set the clock, so it retries immediately.