CI: build and publish every package from Woodpecker

Pushes to main run the tests. The Deploy button publishes the Windows, RPM,
deb and F-Droid packages to the same NAS directories a dev machine uses, with
the same keys, then runs update-repo.sh, so public URLs don't change.

Builds run on Debian 12, in an image defined in ci/builder, so the Linux
packages now need glibc 2.36 instead of Fedora 44's 2.43.

scripts/deb-publish.sh

@@ -13,6 +13,7 @@
 #   --init-key      generate the package signing key (once, ever; skip it if
 #                   rpm-publish.sh already made one, the two share it)
 #   --allow-dirty   publish uncommitted changes; the version gets a ~dirty suffix
+#   --skip-published  finish without error if the repo already has this version
 #
 # Environment:
 #   MTGC_DEB_DIR    repo directory, if not given as an argument
@@ -27,7 +28,7 @@
 set -euo pipefail
 
 usage() {
-    sed -n '3,26p' "$0" | sed 's/^# \{0,1\}//'
+    sed -n '3,27p' "$0" | sed 's/^# \{0,1\}//'
     exit "${1:-0}"
 }
 
@@ -42,11 +43,13 @@ KEEP=3  # versions kept in the repo, so a bad release can be downgraded from
 
 init_key=false
 allow_dirty=false
+skip_published=false
 dir="${MTGC_DEB_DIR:-}"
 while [ $# -gt 0 ]; do
     case "$1" in
         --init-key) init_key=true ;;
         --allow-dirty) allow_dirty=true ;;
+        --skip-published) skip_published=true ;;
         -h | --help) usage ;;
         -*) usage 1 ;;
         *) dir="$1" ;;
@@ -141,7 +144,9 @@ EOF
     sed 's/^$/./; s/^/ /' "$dir/$PACKAGE.asc"
 } >"$dir/$PACKAGE.sources"
 
-# A landing page for whoever opens the repo's address in a browser.
+# A landing page for whoever opens the repo's address in a browser. The package
+# needs at least the glibc it's built against, so that depends on the build host.
+glibc="$(ldd --version | awk 'NR == 1 { print $NF }')"
 cat >"$dir/README.html" <<EOF
 <!doctype html>
 <html lang="en">
@@ -173,8 +178,8 @@ sudo apt update &amp;&amp; sudo apt install $PACKAGE</code></pre>
 <p>From then on, <code>sudo apt upgrade</code> picks up new releases.</p>
 
 <h2>Requirements</h2>
-<p>A 64-bit x86 system with glibc 2.43 or newer (check with <code>ldd --version</code>).
-Older releases, such as Ubuntu 24.04 and Debian 13, can't install it.</p>
+<p>A 64-bit x86 system with glibc $glibc or newer (check with <code>ldd --version</code>).
+Older releases can't install it.</p>
 
 <h2>Uninstall</h2>
 <pre><code>sudo apt remove $PACKAGE
@@ -208,6 +213,10 @@ while read -r version; do
     [ "$patch" -gt "$newest" ] && newest="$patch"
 done < <(repo_ list "$SUITE" "$PACKAGE" 2>/dev/null | awk '{ print $NF }')
 if [ "$release_count" -le "$newest" ]; then
+    if $skip_published; then
+        info "version $release_version is already published; nothing to do"
+        exit 0
+    fi
     err "version $release_version is not newer than the repo's x.y.$newest; commit something first"
     exit 1
 fi