ci-requirements: the two things that cost a cycle each to rediscover

`git push origin dev` fails outright now that the rolling channel put a TAG
named `dev` beside the branch, and the error names neither. And nothing in CI
lints the packaging shell scripts, so a broken installer surfaces when a user
runs it rather than when it's built — record how to check them locally.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MKsUY9Z45KQd34V956hZ9Q

ci-requirements.md

@@ -151,3 +151,35 @@ files behind; `CARGO_HOME` points somewhere writable for that user.
 **Don't infer formatting from existing code.** Several lines in `local/store.rs`
 exceed 100 characters and survive only because rustfmt cannot break a string
 literal — copying that shape caused one of the four failures.
+
+## Pushing: `dev` is both a branch and a tag
+
+`git push origin dev` fails in this repo:
+
+```
+error: src refspec dev matches more than one
+```
+
+The rolling update channel is a release on a **fixed tag named `dev`** (the tag
+never moves — Forgejo has no `/releases/latest/download/<asset>` route, so the
+updater needs a permanent URL). Once that tag is fetched locally, the short name
+`dev` resolves to both `refs/heads/dev` and `refs/tags/dev`. Fully qualify it:
+
+```
+git push origin refs/heads/dev:refs/heads/dev
+```
+
+## Shell scripts have no CI lane
+
+Nothing lints `desktop/packaging/*.sh`, and a broken installer or publish script
+fails at the moment a user runs it, not in a build. Check them before pushing —
+`install.sh` is POSIX sh, the rest are bash:
+
+```
+dash -n desktop/packaging/install.sh          # or: sh -n
+bash -n desktop/packaging/publish-release.sh
+```
+
+Where a script resolves URLs from the Forgejo API, exercise the resolution
+against the live instance (plain `curl` reads, no install) rather than trusting
+the regex by eye. Both channel paths in `install.sh` were verified that way.