[bardesss]

Release pipeline fixes. No app change.

Version from every unreleased commit

• The logic moves to .github/scripts/next-version.sh, with next-version-test.sh run in CI.
• A push run now reads every commit title since the latest v* tag (compare API) instead of only the head commit. A [skip release] push that lands after a cancelled run therefore still ships that run's commits. The bump is the largest [major]/[minor] among the titles that are not skipped.
• A run whose commit is no longer the tip of main exits without a tag. Re-running an old run can no longer publish old code under a new version.
• When no commit is new (for example, re-running the latest run), nothing ships.

Signing

• Tests and lint run in their own test job, which has no secrets. build only assembles and signs, with --no-daemon.
• build runs only on refs/heads/main, dry runs included, and names environment: release.

Repo

• .gitignore adds *.b64, *.p12, *.pem, .env and .kotlin/.

Before merging: create the release environment under Settings > Environments, with deployment branches limited to main. A job naming a missing environment creates it without protection.