CI: build and publish every package from Woodpecker

Pushes to main run the tests. The Deploy button publishes the Windows, RPM,
deb and F-Droid packages to the same NAS directories a dev machine uses, with
the same keys, then runs update-repo.sh, so public URLs don't change.

Builds run on Debian 12, in an image defined in ci/builder, so the Linux
packages now need glibc 2.36 instead of Fedora 44's 2.43.

scripts/ci-publish.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+#
+# ci-publish.sh — publish one target from a Woodpecker step in .woodpecker/release.yaml.
+#
+# Usage:
+#   ./scripts/ci-publish.sh windows|rpm|deb|fdroid
+#
+# Does what a fresh container lacks and a dev machine already has, then runs that
+# target's publish script. The repos and keys are the same directories a dev
+# machine publishes to, mounted at the same path, so either can publish next.
+#
+# Environment:
+#   MTGC_RELEASE_DIR  the mounted release directory (default /nfs/hal9000/mtgc)
+#   MTGC_CI_CACHE     the build cache volume (default /cache)
+#
+set -euo pipefail
+
+usage() {
+    sed -n '3,14p' "$0" | sed 's/^# \{0,1\}//'
+    exit "${1:-0}"
+}
+
+info() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
+err()  { printf '\033[1;31m[err]\033[0m %s\n' "$*" >&2; }
+
+RELEASE_DIR="${MTGC_RELEASE_DIR:-/nfs/hal9000/mtgc}"
+CACHE="${MTGC_CI_CACHE:-/cache}"
+
+[ $# -eq 1 ] || usage 1
+case "$1" in
+    windows) subdir=win ;;
+    rpm) subdir=rpm ;;
+    deb) subdir=deb ;;
+    fdroid) subdir=repo ;;
+    -h | --help) usage ;;
+    *) usage 1 ;;
+esac
+target="$1"
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+# --- 1. Checks --------------------------------------------------------------
+#
+# The version is the commit count, so a shallow clone would call this release
+# 0.1.1. The publish script would refuse that, but not with a helpful message.
+
+if [ "$(git rev-parse --is-shallow-repository)" != false ]; then
+    err "this is a shallow clone; the commit count needs the full history"
+    exit 1
+fi
+
+# --- 2. Build directories ---------------------------------------------------
+#
+# The publish scripts name target/ directly, so link it rather than setting
+# CARGO_TARGET_DIR. It lives on the cache volume, which outlasts the pipeline
+# and has the room: the workspace volume is 10G.
+
+mkdir -p "$CACHE/target" "$HOME"
+ln -sfn "$CACHE/target" target
+
+cargo fetch --locked
+if [ ! -d node_modules ]; then
+    npm ci
+fi
+
+# --- 3. Keys ----------------------------------------------------------------
+#
+# gpg wants its home to be private, and the agent wants a socket there; neither
+# works on the NFS copy. /tmp goes away with the step's pod.
+
+case "$target" in
+    rpm | deb)
+        gnupg="$(mktemp -d)"
+        cp -r "$RELEASE_DIR/keys/gnupg/." "$gnupg/"
+        chmod -R go-rwx "$gnupg"
+        export MTGC_RPM_GNUPGHOME="$gnupg" MTGC_DEB_GNUPGHOME="$gnupg"
+        ;;
+    fdroid)
+        source scripts/android-env.sh >/dev/null
+        android="src-tauri/gen/android"
+        # RustPlugin reads the SDK and NDK from here; a clone doesn't have it.
+        printf 'sdk.dir=%s\nndk.dir=%s\n' "$ANDROID_HOME" "$NDK_HOME" >"$android/local.properties"
+        (
+            umask 077
+            sed "s|^storeFile=.*|storeFile=$RELEASE_DIR/keys/android-release.jks|" \
+                "$RELEASE_DIR/keys/keystore.properties" >"$android/keystore.properties"
+        )
+        ;;
+esac
+
+# --- 4. Publish -------------------------------------------------------------
+
+info "publishing $target to $RELEASE_DIR/$subdir"
+exec "scripts/$target-publish.sh" --skip-published "$RELEASE_DIR/$subdir"