ci: release on merge-to-main; consolidate pipeline triggers

Reworks the pipeline so a change is built once and a release is driven by the
merge, not a manual tag push.

- ci.yaml now runs on pull_request (one gate per PR) instead of every branch
  push, so there's no CI-on-push + CI-on-merge double run. A single `ci` job
  with a docs-only fast-path keeps the required "CI" check always reporting
  (docs/metadata-only PRs skip the Android build but still go green).
- release.yaml triggers on push to main. A cheap `detect` job reads versionName
  from build.gradle; only when no tag for it exists does the `release` job run:
  tests on the merged commit, build + sign, publish to F-Droid, then create the
  vX.Y.Z tag + Gitea release via the API (target_commitish = the merged sha).
  The tag is now an OUTPUT of a successful release, not its trigger — a failure
  before publish leaves no tag, so re-running safely retries. No more separate
  tag-triggered run or duplicate ci job.
- The committed versionName/versionCode are now the source of truth (pipeline
  pins versionCode from versionName); updated the build.gradle comment.
- translations.yaml switched to pull_request (same path filter).
- docs/RELEASING.md: release-by-merge flow, no manual git tag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/verify-release.sh

@@ -39,4 +39,5 @@ echo "  3. Add both home-screen widgets and confirm they render (not a spinner).
 echo "  4. Exercise the release's headline changes end to end."
 echo
 echo "Watch for crashes with:  adb logcat -b crash"
-echo "Only tag the release once all of the above pass on a real device."
+echo "Only merge the release branch to main once all of the above pass on a device"
+echo "(the merge is what publishes the release — see docs/RELEASING.md)."