ci: 修复 workflow YAML + 打包脚本；忽略 runtime/（含 runner 凭据，勿提交）

- heredoc 改为 scripts/build-online.py 调用（YAML merge key 语法修复）
- .gitignore 忽略 runtime/（act-runner 凭据 .runner 及二进制）

.gitea/workflows/auto-release.yml

@@ -35,14 +35,7 @@ jobs:
           cp app/Microsoft.Web.WebView2.Core.dll app/Microsoft.Web.WebView2.WinForms.dll app/WebView2Loader.dll pkg/app/
           cp app/src/dsh-app.cs app/src/app.manifest pkg/app/src/
           cp dsh.ico README.md install.cmd uninstall.vbs register-uninstall.ps1 pkg/
-          cd pkg && python - <<'PY'
+          cd pkg && python ../scripts/build-online.py ../dsh-desktop-online.zip
-import zipfile, os
-with zipfile.ZipFile('../dsh-desktop-online.zip', 'w', zipfile.ZIP_DEFLATED) as z:
-    for r, _, fs in os.walk('.'):
-        for f in fs:
-            p = os.path.join(r, f)
-            z.write(p, os.path.relpath(p, '.'))
-PY
 
       - name: Create release
         id: release

.gitignore

@@ -9,3 +9,6 @@ start-error.log
 
 # WebView2 用户数据（仓库根下的缓存目录）
 EBWebView/
+
+# runner 凭据（勿提交）
+runtime/

scripts/build-online.py

@@ -0,0 +1,12 @@
+"""Build dsh-desktop-online.zip from the current working directory."""
+import zipfile, os, sys
+
+out = sys.argv[1] if len(sys.argv) > 1 else '../dsh-desktop-online.zip'
+count = 0
+with zipfile.ZipFile(out, 'w', zipfile.ZIP_DEFLATED) as z:
+    for r, _, fs in os.walk('.'):
+        for f in fs:
+            p = os.path.join(r, f)
+            z.write(p, os.path.relpath(p, '.'))
+            count += 1
+print('ZIP:', out, '%.1f MB' % (os.path.getsize(out) / 1048576), count, 'files')