build: move releases to CI and trim the Makefile

Merging a pull request into main is now the whole release. A Gitea
Actions workflow derives the CalVer tag, builds the image and pushes
it with :latest, so nothing is built locally any more.

That made image/push/release redundant, and with them the .release-tag
state file and the main-branch guard — the workflow only runs on main,
which is protected, so the guard had nothing left to catch. The digest
verification went too: it guarded a `make -j` race between image and
push that cannot happen in a single CI job.

seed, icons and vendor ran a few times a year and are written out in
the README instead. Makefile: 151 lines to 71.

Docs referenced the removed targets in sixteen places, including a
CONTRIBUTING note claiming the branch check "has to be local".

CONTRIBUTING.md

@@ -29,9 +29,9 @@ git switch dev && git reset --hard main
 git push --force-with-lease origin dev
 ```
 
-`make image` refuses to run outside `main`. That check has to be local: the
-tag and the image are made before anything reaches the remote, so branch
-protection cannot catch a release built from the wrong branch.
+The release workflow only triggers on `main`, and `main` only moves through a
+pull request, so a release can never be built from the wrong branch. Nothing
+needs to check for it.
 
 ## Commit messages
 
@@ -71,7 +71,7 @@ release: repair the catalog 404 and stop the page jumping
 
 `main`'s log is then one line per deployment, which is what that branch is
 for, and the pull request body serves as the release notes. No version in the
-title — the CalVer tag is not created until `make image` runs after the merge.
+title — CI creates the CalVer tag after the merge, so it is not known yet.
 
 The types above are for `dev`, where a commit really does do one thing.