Gitea Actions: compile check, virtual-drone smoke flight validated with
DuckDB, read-only SQL gate tests, Trivy vuln and misconfig scans. Pushes
to main cut a semantic version from the conventional-commit type and
publish a release with a fleet release manifest and source bundle.
