Change --unshare-net skip logic to trigger whenever filterProxy is set,
not just for wildcard allow configs. The filtering proxy always listens
on host 127.0.0.1 and requires sandboxed processes to reach the host
network via env-var-based proxying. Also upgrade golangci-lint-action to v7.
Retarget GoReleaser to publish to Gitea (gitea_urls, release.gitea,
changelog.use: gitea). Add Gitea Actions workflows for build/test,
release, and benchmarks — adapted from GitHub equivalents with macOS
jobs and SLSA provenance dropped. Old .github/workflows/ kept in place.
