Name the organisation the repository actually lives in

It moved to DodoTech-Public, and every address in the product still said
DodoTech. That looked like it worked, which is the part worth writing down:
Gitea leaves a 301 at the old path and HttpClient follows a redirect on a GET, so
both update channels would have kept polling through it.

What a 301 does not survive is a POST. `vpk upload gitea` publishes the desktop
release by POSTing to that URL, so the stale address would have failed at the one
step the whole feature depends on — and a redirect is a thing an operator can
delete, which turns "works today" into the same silent outage this session has
already spent two commits on.

So both channel constants, both release scripts, the workflow's REPO, the image's
source label and the curl in phase 16 all name the live path. The local remote
too, which had been printing a redirect warning on every push.

Measured after the move: the org, the repo and the nightly release all answer 200
anonymously, and that release now carries both assets — the manifest and a 54 MB
APK. The upload going through also answers the open question about the reverse
proxy's body-size limit, which nothing local could test.

src/DodoSSH.Client.App/Platform/VelopackUpdateChannel.cs

@@ -75,14 +75,24 @@ internal sealed class VelopackUpdateChannel : IUpdateChannel
     /// </summary>
     /// <remarks>
     /// <b>This must never become a setting.</b> ADR 0011 rule 2 says the deployment a client signs in to
+    /// <para>
     /// is never where the client comes from, and it says the same about the update check: an operator who
     /// can answer "is there a newer version" can answer "no" forever, and pin a chosen user to a build
     /// with a known hole without holding any key. A configurable feed URL is exactly the knob that would
     /// hand them that, whether through a settings screen or through somebody editing the plaintext
     /// settings.json by hand. A constant is that rule expressed structurally rather than as a convention
     /// somebody has to keep.
+    /// </para>
+    /// <para>
+    /// ◆ <b><c>DodoTech-Public</c>, and the owner is part of the address rather than incidental.</b> The
+    /// repository was moved between organisations, and Gitea leaves a 301 behind at the old path — which is
+    /// why a client pointing at the old one appears to work: <c>HttpClient</c> follows a redirect on a GET.
+    /// It does not follow one on a POST, so <c>vpk upload</c> against the stale URL fails rather than
+    /// redirecting, and a redirect is a thing an operator can remove. Both heads and both release scripts
+    /// name the live path.
+    /// </para>
     /// </remarks>
-    private const string RepositoryUrl = "https://git.dodotech.cloud/DodoTech/DodoSSH";
+    private const string RepositoryUrl = "https://git.dodotech.cloud/DodoTech-Public/DodoSSH";
 
     /// <summary>
     /// The release channel to read, and it is stated rather than left to the default.