ci(release): exact tag checks and a retryable beta publish (#40)

### What this changes

- New `scripts/release_gate.sh`, used by the `detect` jobs of both `release.yaml` and `beta.yaml`, decides whether the committed version still needs publishing. Tags are read by exact name via `git ls-remote` instead of Codeberg's `git/refs/tags/<name>` API.
- A beta counts as done only once its Codeberg pre-release carries the APK, so a publish that failed part-way is redone by the next push of the branch.
- A beta is refused unless it is newer than the latest stable tag (previously only an exact `vX.Y.Z` tag was checked).
- `publish_codeberg_release.sh` fails a pre-release when `CODEBERG_RELEASE_TOKEN` is missing (stable still skips), fails on any asset upload that doesn't return 201, and no longer aborts when the asset listing returns an error.
- `version_info.sh` rejects leading zeros (`1.1.0-beta.01` would have shared `beta.1`'s versionCode under a different tag).
- `beta.yaml` header and `docs/RELEASING.md` updated to match.

### Why

Codeberg's `git/refs/tags/<name>` matches by prefix: asking for `v1.1.0` returns 200 because `v1.1.0-beta.1` exists. Merging 1.1.0 into `main` would have logged "tag already exists" and shipped nothing while the run stayed green, and `1.1.0-beta.2` would have been refused as "already shipped stable".

`release/v1.1.0` needs `main` merged in after this lands, since `beta.yaml` runs from the pushed branch's files.

### Also in here

`gradle/gradle-daemon-jvm.properties` now points at JetBrains' own download URLs for JBR 21.0.11 instead of foojay. foojay dropped JetBrains 21 from its index, so the pinned package ids return 400 and CI couldn't provision the daemon JVM (unrelated to the release change, but it blocks every PR until fixed).

### Checklist

- [x] No `values-*/strings.xml` touched
- [x] No `versionName` / `versionCode` bump
- [x] `CHANGELOG.md` not updated: release infrastructure, not a user-visible change

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/40

docs/RELEASING.md

@@ -112,9 +112,11 @@ and to the stable release.
 2. **Optionally verify it on a device** with `scripts/verify-release.sh`, as for
    a stable release.
 3. **Push the branch to Codeberg.** When it reaches Gitea, `beta.yaml` sees a
-   beta version without a tag, runs the unit tests, builds and signs the APK,
-   creates the `vX.Y.Z-beta.1` tag + a Gitea pre-release (with the R8 mapping)
-   and publishes the **Codeberg pre-release** with the APK + `.sha256`.
+   beta whose Codeberg pre-release doesn't carry its APK yet, runs the unit
+   tests, builds and signs the APK, creates the `vX.Y.Z-beta.1` tag + a Gitea
+   pre-release (with the R8 mapping) and publishes the **Codeberg
+   pre-release** with the APK + `.sha256`. If that publish fails part-way, the
+   next push of the branch redoes it.
 4. **Next round:** bump to `-beta.2` (and its `versionCode`) and push again.
 5. **Going stable:** set `versionName = "X.Y.Z"` and its `versionCode`
    (`1.1.0` → `1010099`), then continue from step 2 of
@@ -130,8 +132,8 @@ Who gets a beta:
 - **Play** never.
 
 Guards: a beta version can't reach `main` (CI fails the PR, and `release.yaml`'s
-`detect` refuses one as a backstop), `beta.yaml` refuses a beta of a version
-that already shipped stable, and betas start at 1.1.0 (the 1.0.x codes have no
+`detect` refuses one as a backstop), `beta.yaml` refuses a beta that isn't
+newer than the latest stable release, and betas start at 1.1.0 (the 1.0.x codes have no
 room below them).
 
 ---