[mechiland]

Keep one theme package working across Gitea 1.27.3 and 28.0.0–28.3.0. Preserve each version’s native forced-password navbar while using a compatible flex layout for GitHub themes.

• Use a shared version matrix for upstream checks, package metadata and CI; reserve CSS variables across all versions, retain upstream-only tokens, and isolate page-scope caches by version and instance.
• Build the release candidate once and test the unchanged archive in disposable containers for all five versions. Gate tag releases on successful results with matching archive SHA-256 values.
• Preserve main’s visual regression gate on 1.27.3 and 28.2.0; share upstream sources with reference builds. Update install, architecture and test documentation.
• Switch templates inside the container as its git user so the tests work with Linux bind-mount ownership.

Validation on the latest head (8ab07d7):

• Remote CI passed: both visual regression jobs, strict build, and every compatibility target.
• Gitea 1.27.3: passed.
• Gitea 28.0.0: passed.
• Gitea 28.1.0: passed.
• Gitea 28.2.0: passed.
• Gitea 28.3.0: passed.
• Downloaded all five remote reports and verified they tested the same archive SHA-256: d2a3a51c3eda6b219c7c1c5b7d299865999a84336ad96a835be9a2ec67ca5e94.
• Locally: five build/packaging regression tests, strict lint/build, actionlint, and the five-version container/browser matrix (856 page combinations).