build: move releases to CI and trim the Makefile

Merging a pull request into main is now the whole release. A Gitea
Actions workflow derives the CalVer tag, builds the image and pushes
it with :latest, so nothing is built locally any more.

That made image/push/release redundant, and with them the .release-tag
state file and the main-branch guard — the workflow only runs on main,
which is protected, so the guard had nothing left to catch. The digest
verification went too: it guarded a `make -j` race between image and
push that cannot happen in a single CI job.

seed, icons and vendor ran a few times a year and are written out in
the README instead. Makefile: 151 lines to 71.

Docs referenced the removed targets in sixteen places, including a
CONTRIBUTING note claiming the branch check "has to be local".

.gitignore

@@ -4,9 +4,6 @@
 # Build output
 /foodster
 
-# The tag `make image` last built, handed to `make push`.
-/.release-tag
-
 # Generated by `templ generate` during the container build.
 *_templ.go