ci(winget): name the two gates that each cost a release to discover

Both are documented upstream and neither is guessable from the workflow.

A fine-grained PAT does not work — winget-releaser#172. The token has to be a
classic one with `public_repo`. Someone reading "a PAT with public_repo scope"
in 2027 will mint the kind GitHub now offers by default, and lose a release
finding out.

And the action refuses to run at all until one version of the package already
exists in winget-pkgs: it writes the next manifest by copying the previous one,
so it cannot author the first. Its own pre-flight says so ("Please add atleast
one version of the package before using this action"), which is loud but arrives
only after the token exists and the release has been cut. The first submission is
manual, `wingetcreate new`, and the automation takes over from the second.

Also names the fork requirement, since `fork-user` defaults to the repository
owner and therefore expects getopenscreen/winget-pkgs to exist.

Author: EtienneLescot

.github/workflows/publish-winget.yml

@@ -31,10 +31,16 @@ jobs:
       # la présence du token sans jamais exposer sa valeur.
       HAS_TOKEN: ${{ secrets.WINGET_ACC_TOKEN != '' }}
     steps:
+      # Les deux pièges nommés ici sont documentés chez l'action et coûteraient chacun
+      # une release pour être découverts : un PAT fine-grained N'EST PAS supporté
+      # (vedantmgoyal9/winget-releaser#172), et l'action refuse de tourner tant qu'aucune
+      # version du paquet n'existe déjà dans winget-pkgs — elle part d'un manifeste
+      # existant pour écrire le suivant. La première soumission est donc manuelle,
+      # `wingetcreate new`, et l'automatisation ne prend le relais qu'ensuite.
       - name: Report that winget publishing is not configured
         if: env.IDENTIFIER == '' || env.HAS_TOKEN != 'true'
         run: |
-          echo "::warning title=winget publishing skipped::Nothing was published to winget. Needs the repository variable WINGET_IDENTIFIER (the winget package identifier, e.g. OpenScreen.OpenScreen) and the secret WINGET_ACC_TOKEN (a PAT with public_repo scope, on an account that has forked microsoft/winget-pkgs). Currently WINGET_IDENTIFIER=${{ env.IDENTIFIER == '' && 'unset' || 'set' }}, WINGET_ACC_TOKEN=${{ env.HAS_TOKEN == 'true' && 'set' || 'unset' }}. See https://github.com/getopenscreen/openscreen/issues/148"
+          echo "::warning title=winget publishing skipped::Nothing was published to winget. Needs (1) the repository variable WINGET_IDENTIFIER, currently ${{ env.IDENTIFIER == '' && 'UNSET' || 'set' }}; (2) the secret WINGET_ACC_TOKEN, currently ${{ env.HAS_TOKEN == 'true' && 'set' || 'UNSET' }} — a CLASSIC PAT with public_repo scope, fine-grained tokens are not supported; (3) a fork of microsoft/winget-pkgs under getopenscreen; and (4) at least one version of the package already merged into winget-pkgs, since this action updates an existing manifest and refuses to create the first one. See https://github.com/getopenscreen/openscreen/issues/148"
 
       # Épinglé sur le SHA de v2 : un tag git est mutable, et cette action tierce
       # reçoit WINGET_ACC_TOKEN. Un tag repointé suffirait à exfiltrer le token