Gitea Actions: compile check, virtual-drone smoke flight validated with DuckDB, read-only SQL gate tests, Trivy vuln and misconfig scans. Pushes to main cut a semantic version from the conventional-commit type and publish a release with a fleet release manifest and source bundle.