feat(vcs): address a release source by forge endpoint

Implements spec 0192 — release sources address a forge by endpoint.

go/forge v0.12.0 replaced ReleaseSourceConfig with a comparable Endpoint{Type, Host, Name} carrying connection identity only, and moved provider-specific settings into the endpoint's configuration subtree. GTB pinned v0.11.0 and did not compile against v0.14.1. This adopts the endpoint model and takes the forge family across, which also closes the lockstep gap: all four adapters now pair with core v0.14.1.

What changed

• props.ReleaseSource.Params is removed, not shimmed (D1). It reached one provider, which no longer reads it, and a single map on a shared struct can only ever describe one source per type. Settings are configuration now, under the source's own subtree, which two sources can share.
• Every construction site names its provider type (D2).
• pkg/vcs/repo.SettingsFromReader takes props.ReleaseSource (D4). forge has no type left that carries Private, and the import cycle its old parameter existed to avoid no longer exists.
• The dependency bump travels here rather than in Renovate's !421 (closed) (D5), which is red on this exact breakage and will go empty once this lands.

Two fixes that came out of it

A provider could be built with the wrong type. resolveReleaseClient set Type from p.Tool.ReleaseSource.Type while forge.Lookup used vcsProvider, which honours a vcs.provider config override. A tool overriding its provider got a factory for one type constructed with the name of another. Inert while nothing read the field; not inert now that Endpoint.Section scopes the config subtree by it.

Two capability lookups built a provider with no type at all. defaultForgeProvider and defaultKeyManager passed only a host. That worked only because nothing validated it — the factory was already chosen by Lookup(profile.Provider), so the type was implied. Under the endpoint model an untyped endpoint is worse than an error: configAdapter.Sub("") does not report the empty section as absent, so a provider that nil-guards its config sees a non-nil section prefixed . and reads every key as an empty string, with no diagnostic anywhere.

Tests

Two new assertions, both checked red-first (reverting the Type on either site fails the first at that site):

• TestCapabilityLookupsNameTheProviderType asserts on the endpoint the factory actually receives, so it survives either function being rewritten.
• TestEndpointSectionResolvesTheTypeSubtree covers the join between GTB's config adapter and the module's scoping — the one place the two could diverge silently while every provider-stubbing test stayed green.

No Gherkin scenarios: this changes how a provider is constructed, not what any command does.

Verification

• just lint — 0 issues
• just test-race — pass, no races
• Coverage: pkg/vcs 100%, pkg/vcs/repo 94.7%, pkg/setup/forge 92.0%, pkg/props 93.2%
• A scaffolded project built against this branch. The generator emits no Params — ManifestReleaseSource never carried one — so no template change was needed, but the e2e suite hand-wires its features and would not have caught it either way.

Docs

Six files updated, plus a migration note at docs/reference/migration/v0.x-release-source-params-removed.md covering the field's removal and the configuration keys that replace it.