ci: release from the production branch, version from the project file

Two branches: dev for everyday work, production for releases.

- ci.yml builds and packs on dev and on pull requests; it never publishes.
- release.yml runs on a push (usually a merge) into production: reads
  <Version> from the csproj, refuses to proceed if that tag already
  exists, publishes to nuget.org, and only then creates the tag and the
  Gitea release — so a tag always means a published package.
- Drop --skip-duplicate: a duplicate push must fail loudly instead of
  reporting success while shipping nothing.

.gitea/workflows/ci.yml

@@ -1,11 +1,12 @@
 name: CI
 
+# Everyday checks. Runs on the working branch and on pull requests into it.
+# Releasing is a separate workflow driven by the production branch.
 on:
   push:
-    branches: [main]
-    tags: ["v*"]
+    branches: [dev]
   pull_request:
-    branches: [main]
+    branches: [dev, production]
 
 jobs:
   build:
@@ -20,7 +21,7 @@ jobs:
       - name: Restore
         run: dotnet restore
 
-      # Directory.Build.props turns warnings into errors, so this also gates style.
+      # Directory.Build.props turns warnings into errors, so this gates style too.
       - name: Build
         run: dotnet build --configuration Release --no-restore
 
@@ -32,39 +33,3 @@ jobs:
         with:
           name: nupkg
           path: artifacts/*
-
-  publish:
-    # Tag pushes only: v1.2.3 publishes version 1.2.3 to nuget.org.
-    needs: build
-    if: startsWith(gitea.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Derive version from tag
-        id: version
-        run: echo "value=${GITEA_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
-        env:
-          GITEA_REF: ${{ gitea.ref }}
-
-      - name: Pack
-        run: >
-          dotnet pack src/CertifiEd.Client/CertifiEd.Client.csproj
-          --configuration Release
-          -p:Version=${{ steps.version.outputs.value }}
-          --output artifacts
-
-      # NUGET_API_KEY must be added as a repository secret. Without it the step
-      # fails loudly rather than silently shipping nothing.
-      - name: Push to nuget.org
-        run: >
-          dotnet nuget push "artifacts/*.nupkg"
-          --source https://api.nuget.org/v3/index.json
-          --api-key "$NUGET_API_KEY"
-          --skip-duplicate
-        env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}