fix: use stdenv.hostPlatform.system, not the removed pkgs.system

nixpkgs renamed it, and the shim warns on every evaluation that imports this
module, so the noise lands on consumers rebuilding their systems rather than
here.

flake.nix

@@ -109,15 +109,17 @@
           name = "bunshin";
         };
 
-        # Builds packages.static and uploads it to this repo owner's
+        # Builds packages.static and publishes it as a Forgejo release on
-        # Forgejo generic package registry, tagged by short commit hash.
+        # this repo, tagged by short commit hash (creating the release if
-        # Needs FORGEJO_TOKEN (a token with write:package scope) in the
+        # it doesn't exist yet, replacing the asset if it does — safe to
-        # environment; run from a checkout so `git rev-parse` and the `.`
+        # rerun for the same commit). Needs FORGEJO_TOKEN (a token with
-        # flake ref resolve to the right place.
+        # write:repository scope) in the environment; run from a checkout
+        # so `git rev-parse` and the `.` flake ref resolve to the right
+        # place.
         apps.release-static = flake-utils.lib.mkApp {
           drv = pkgs.writeShellApplication {
             name = "bunshin-release-static";
-            runtimeInputs = [ pkgs.nix pkgs.curl pkgs.git ];
+            runtimeInputs = [ pkgs.nix pkgs.curl pkgs.git pkgs.jq ];
             text = ''
               if [ -f .env ]; then
                 set -a
@@ -125,12 +127,31 @@
                 . ./.env
                 set +a
               fi
+              : "''${FORGEJO_TOKEN:?set FORGEJO_TOKEN (env or .env) to a Forgejo token with write:repository scope}"
+
               rev=$(git rev-parse --short HEAD)
+              sha=$(git rev-parse HEAD)
               out=$(nix build .#static --no-link --print-out-paths)
-              : "''${FORGEJO_TOKEN:?set FORGEJO_TOKEN (env or .env) to a Forgejo token with write:package scope}"
+              bin="$out/bin/bunshin"
-              url="https://code.randogoth.com/api/packages/randogoth/generic/bunshin/$rev/bunshin"
+
-              curl -sSf -H "Authorization: token ''${FORGEJO_TOKEN}" --upload-file "$out/bin/bunshin" "$url"
+              api="https://code.randogoth.com/api/v1/repos/randogoth/bunshin"
-              echo "uploaded: $url"
+              auth=(-H "Authorization: token ''${FORGEJO_TOKEN}")
+
+              release_id=$(curl -sS "''${auth[@]}" "$api/releases/tags/$rev" | jq -r '.id // empty')
+              if [ -z "$release_id" ]; then
+                release_id=$(curl -sSf "''${auth[@]}" -H "Content-Type: application/json" \
+                  -d "$(jq -n --arg tag "$rev" --arg sha "$sha" \
+                    '{tag_name:$tag, target_commitish:$sha, name:$tag, body:"Static musl build.", draft:false, prerelease:false}')" \
+                  "$api/releases" | jq -r '.id')
+              fi
+
+              asset_id=$(curl -sSf "''${auth[@]}" "$api/releases/$release_id/assets" | jq -r '.[] | select(.name=="bunshin") | .id' | head -1)
+              if [ -n "$asset_id" ]; then
+                curl -sSf -X DELETE "''${auth[@]}" "$api/releases/$release_id/assets/$asset_id" >/dev/null
+              fi
+              curl -sSf "''${auth[@]}" -F "attachment=@$bin;filename=bunshin" "$api/releases/$release_id/assets?name=bunshin" >/dev/null
+
+              echo "released: https://code.randogoth.com/randogoth/bunshin/releases/tag/$rev"
             '';
           };
         };
@@ -151,7 +172,7 @@
 
               package = mkOption {
                 type = types.package;
-                default = self.packages.${pkgs.system}.default;
+                default = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
                 description = ''
                   bunshin package to run. Use `packages.rns` when the RNS
                   carrier is enabled: the default package is built without it.