fix(bump): Release-Modell nach D8/D9, atomarer Push (#3)

## Was

Folge-PR zum Review von #2 gegen `zugaenge.md`, D8, D9 und W4 in oumta-deploy.

- `production/*`: kein Bump, der Schritt bricht mit Hinweis ab. Ein Release ist ein Retag (D9, W4).
- `main` hat keine Release-Rolle mehr. Stabile Tags gibt es nur über `settings.release_branch` als Patch-Bump, für Repos ohne Majors wie oumta-keyklo. Die Commit-Message wird nicht mehr ausgewertet.
- Linie für dev-Tags: der nächste `release/*`- oder `hotfix/*`-Branch nach jüngster Merge-Base, bei Gleichstand die niedrigere Linie. Vorher zählten nur `release/*` und nur Branch-Spitzen.
- Existiert das stabile Tag einer Linie (`v2.4.0`), geht es mit dem nächsten Patch weiter (`v2.4.1-beta.0`). Vorher blieb die Beta-Linie auf `.0` stehen und der nächste Promote wäre an „Version noch frei“ gescheitert.
- `hotfix/X.Y` ohne Patch wird abgelehnt, es würde mit `release/X.Y` kollidieren.
- Branch und Tag gehen in einem atomaren Push. Vorher konnte der Bump-Commit ohne Tag landen und jeder weitere Lauf stieg mit Exit 0 aus.
- README: Regeln, Einschränkung des Secrets auf Images und Events, Paket-Schreibrecht von `oumta-ci` in `actions`, Beispiel ohne `develop`.

## Getestet

Lokal als Image gegen ein Bare-Repo: feature von develop, erste und zweite Beta, feature von release, hotfix mit und ohne Patch, production, `release_branch`, `release_line`, Linie nach stabilem Tag, weitergelaufener Branch, fehlendes Token.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #3

README.md

@@ -120,7 +120,9 @@ jobs:
 
 ## Woodpecker plugins
 
-Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version.
+Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version. The push uses `oumta-ci` with the Woodpecker secret `oumta_ci_token`, so `oumta-ci` needs package write access in the org `actions`.
+
+The secret `oumta_ci_token` holds the one token `oumta-ci` writes with. Limit it in Woodpecker to the images `woodpeckerci/plugin-docker-buildx:6`, `git.uesome.de/actions/ci-cd/bump` and `git.uesome.de/actions/ci-cd/deploy` and to the events `push`, `tag` and `manual` (zugaenge.md in oumta-deploy).
 
 ### deploy
 
@@ -169,19 +171,23 @@ steps:
 
 ### bump
 
-Sets the version for the pushed branch in `package.json`, commits it as `update version: vX [skip ci]`, tags it and pushes branch and tag. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events.
+Sets the version for the pushed branch in `package.json`, commits it as `update version: vX.Y.Z [skip ci]`, tags it and pushes branch and tag in one atomic push. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events.
 
-- `main`: release from the commit message (`release/x.y[.z]`, `hotfix/x.y.z`), otherwise a patch bump
-- `release/*`, `hotfix/*`: next `vX.Y.Z-beta.N`
-- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the release line comes from `release_line`, the newest ancestor `release/*` branch, or `package.json`
+- `release/X.Y[.Z]`, `hotfix/X.Y.Z`: next `vX.Y.Z-beta.N` of that line (D8). A hotfix needs a patch number.
+- `production/*`: no bump, the step fails. A release is a retag of a beta image (D9).
+- the branch in `release_branch` (repos without majors, e.g. oumta-keyklo `main`): next free `vX.Y.Z`, a patch bump from `package.json`
+- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the line comes from `release_line`, the branch name, the nearest `release/*` or `hotfix/*` branch (newest merge base), or `major.minor` from `package.json`
 
-Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over.
+If the stable tag of a line exists (`v2.4.0` after the release), the next patch of that line is used (`v2.4.1-beta.0`, `v2.4.1-dev.…`).
+
+Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over. The same happens when the push is rejected because of a race: branch and tag are pushed atomically, so either both land or neither.
 
 Settings:
 
-- `git_token` (required): token with write access to the repo (`oumta_ci_token`)
+- `git_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to the repo
 - `git_user`: default `oumta-ci`
-- `release_line`: optional, `<major>.<minor>[.<patch>]`
+- `release_branch`: optional, branch that gets stable tags instead of dev tags
+- `release_line`: optional, `<major>.<minor>[.<patch>]`, overrides every other rule
 - `author_name`, `author_email`: default `oumta-ci`, `oumta-ci@noreply.git.uesome.de`
 - `remote`: default `CI_REPO_CLONE_URL`
 
@@ -190,7 +196,7 @@ Example:
 ```yaml
 when:
   - event: push
-    branch: [develop, 'feature/**', 'release/**', 'hotfix/**']
+    branch: ['feature/**', 'release/**', 'hotfix/**']
   - event: manual
 
 steps: