* chore: unified release workflow (git-cliff changelog + tag + optional bump)
- cliff.toml: git-cliff config (commit.author.name, Weblate/version-bump excluded)
- release.yml: replaces the 'Release Version Bump' workflow with a single
workflow that cuts the current release (changelog + tag + draft release)
and optionally bumps App.php to the next dev version
- build-release.yml: add official-release job (draft GitHub Release with
changelog + assets, triggered by tag push)
Supersedes the 'changelog only' scope: this now also handles tagging,
draft release, and the version bump in one place.
* fix(release): fail fast when a tag does not match the App.php version
Catches a manually-pushed mismatched tag before building, so a draft
release is never created without its archive.
* fix(release): move env block to step level (was inside run shell script)
The env: key was dedented into the run: | literal block, so the shell
would try to execute 'env:' as a command and abort the build.
