Two branches: dev for everyday work, production for releases.
- ci.yml builds and packs on dev and on pull requests; it never publishes.
- release.yml runs on a push (usually a merge) into production: reads
<Version> from the csproj, refuses to proceed if that tag already
exists, publishes to nuget.org, and only then creates the tag and the
Gitea release — so a tag always means a published package.
- Drop --skip-duplicate: a duplicate push must fail loudly instead of
reporting success while shipping nothing.