CI: build and publish every package from Woodpecker

Pushes to main run the tests. The Deploy button publishes the Windows, RPM,
deb and F-Droid packages to the same NAS directories a dev machine uses, with
the same keys, then runs update-repo.sh, so public URLs don't change.

Builds run on Debian 12, in an image defined in ci/builder, so the Linux
packages now need glibc 2.36 instead of Fedora 44's 2.43.

scripts/rpm-publish.sh

@@ -12,6 +12,7 @@
 # Options:
 #   --init-key      generate the package signing key (once, ever)
 #   --allow-dirty   publish uncommitted changes; the RPM release becomes 0.dirty
+#   --skip-published  finish without error if the repo already has this version
 #
 # Environment:
 #   MTGC_RPM_DIR    repo directory, if not given as an argument
@@ -26,7 +27,7 @@
 set -euo pipefail
 
 usage() {
-    sed -n '3,25p' "$0" | sed 's/^# \{0,1\}//'
+    sed -n '3,26p' "$0" | sed 's/^# \{0,1\}//'
     exit "${1:-0}"
 }
 
@@ -40,11 +41,13 @@ KEEP=3  # versions kept in the repo, so a bad release can be downgraded from
 
 init_key=false
 allow_dirty=false
+skip_published=false
 dir="${MTGC_RPM_DIR:-}"
 while [ $# -gt 0 ]; do
     case "$1" in
         --init-key) init_key=true ;;
         --allow-dirty) allow_dirty=true ;;
+        --skip-published) skip_published=true ;;
         -h | --help) usage ;;
         -*) usage 1 ;;
         *) dir="$1" ;;
@@ -142,6 +145,10 @@ for rpm_file in "$dir/$PACKAGE"-*.rpm; do
     [ "$patch" -gt "$newest" ] && newest="$patch"
 done
 if [ "$release_count" -le "$newest" ]; then
+    if $skip_published; then
+        info "version $release_version is already published; nothing to do"
+        exit 0
+    fi
     err "version $release_version is not newer than the repo's x.y.$newest; commit something first"
     exit 1
 fi
@@ -159,7 +166,9 @@ if [ -z "$built" ]; then
     err "the build produced no RPM under $outputs"
     exit 1
 fi
-rpmsign --addsign --define "_gpg_path $GNUPGHOME" --define "_gpg_name $fpr" "$built" >/dev/null
+# Debian's rpm looks for gpg2, which only Fedora has, so name the gpg in use.
+rpmsign --addsign --define "__gpg $(command -v gpg)" --define "_gpg_path $GNUPGHOME" \
+    --define "_gpg_name $fpr" "$built" >/dev/null
 
 # --- 7. Publish -------------------------------------------------------------