👷 Skip main CI run for release commits

A release pushes main and then a tag pointing at the same commit, so
the branch run re-verifies the identical SHA the tag run already
verifies (and publishes). Add a cheap release-gate job that recognizes
the '🔖 Release x.y.z' commit message on main and skips the
full build/maintain jobs; tag, PR, and ordinary main pushes are
unaffected, and the gate fails open (runs CI) if it errors.

scripts/release.sh

@@ -102,6 +102,10 @@ fi
 
 echo "Amending release commit..."
 git add package.json package-lock.json "${CHANGELOG}"
+# The exact message format is load-bearing: the `release-gate` job in
+# .gitea/workflows/ci.yml recognizes `:bookmark: Release x.y.z` on main and
+# skips the full CI run, since the tag push immediately after verifies the
+# identical SHA (and publishes). Keep the two in sync.
 git commit --amend -m ":bookmark: Release ${VERSION}"
 
 echo "Creating tag ${VERSION}..."