CI: build and publish every package from Woodpecker

Pushes to main run the tests. The Deploy button publishes the Windows, RPM,
deb and F-Droid packages to the same NAS directories a dev machine uses, with
the same keys, then runs update-repo.sh, so public URLs don't change.

Builds run on Debian 12, in an image defined in ci/builder, so the Linux
packages now need glibc 2.36 instead of Fedora 44's 2.43.

scripts/windows-publish.sh

@@ -9,6 +9,7 @@
 #
 # Options:
 #   --allow-dirty   publish uncommitted changes; the file name gets a -dirty suffix
+#   --skip-published  finish without error if the repo already has this version
 #
 # Environment:
 #   MTGC_WINDOWS_DIR  downloads directory, if not given as an argument
@@ -23,7 +24,7 @@
 set -euo pipefail
 
 usage() {
-    sed -n '3,22p' "$0" | sed 's/^# \{0,1\}//'
+    sed -n '3,23p' "$0" | sed 's/^# \{0,1\}//'
     exit "${1:-0}"
 }
 
@@ -37,10 +38,12 @@ LATEST="$PACKAGE-latest-x64-setup.exe"
 KEEP=3  # versions kept in the folder, so a bad release can be rolled back
 
 allow_dirty=false
+skip_published=false
 dir="${MTGC_WINDOWS_DIR:-}"
 while [ $# -gt 0 ]; do
     case "$1" in
         --allow-dirty) allow_dirty=true ;;
+        --skip-published) skip_published=true ;;
         -h | --help) usage ;;
         -*) usage 1 ;;
         *) dir="$1" ;;
@@ -98,6 +101,10 @@ for exe in "$dir/${PACKAGE}"_*_x64-setup.exe; do
     [ "$patch" -gt "$newest" ] && newest="$patch"
 done
 if [ "$release_count" -le "$newest" ]; then
+    if $skip_published; then
+        info "version $release_version is already published; nothing to do"
+        exit 0
+    fi
     err "version $release_version is not newer than the folder's x.y.$newest; commit something first"
     exit 1
 fi