feat(bump)!: nur Tag, kein Versions-Commit

Der Build nimmt die Version aus dem Tag (CI_COMMIT_TAG als Build-Arg VERSION),
package.json bleibt unberührt. Damit bleibt der Head-Commit eines PRs der des
Entwicklers und behält seinen Status-Check; [skip ci] entfällt.

- settings.release_branch: nächste stabile Version = höchster Patch der Linie + 1
- ein Commit, der schon ein v*-Tag trägt, wird nicht erneut getaggt (kein Doppel-Build)
- Image auf alpine:3.20 wie deploy, node wird nicht mehr gebraucht
- author_name/author_email entfallen

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -154,6 +154,8 @@ steps:
       registry: git.uesome.de
       repo: git.uesome.de/tanztee/oumta-auth
       tags: ${CI_COMMIT_TAG}
+      build_args:
+        VERSION: ${CI_COMMIT_TAG}
       username: oumta-ci
       password:
         from_secret: oumta_ci_token
@@ -171,16 +173,16 @@ steps:
 
 ### bump
 
-Sets the version for the pushed branch in `package.json`, commits it as `update version: vX.Y.Z [skip ci]`, tags it and pushes branch and tag in one atomic push. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events.
+Derives the next version for the pushed branch and pushes it as a tag on the triggering commit. There is no version commit: the build takes the version from the tag (`CI_COMMIT_TAG`, e.g. as build arg `VERSION`), `package.json` stays untouched. The tag event then starts the build.
 
 - `release/X.Y[.Z]`, `hotfix/X.Y.Z`: next `vX.Y.Z-beta.N` of that line (D8). A hotfix needs a patch number.
 - `production/*`: no bump, the step fails. A release is a retag of a beta image (D9).
-- the branch in `release_branch` (repos without majors, e.g. oumta-keyklo `main`): next free `vX.Y.Z`, a patch bump from `package.json`
+- the branch in `release_branch` (repos without majors, e.g. oumta-keyklo `main`): next stable `vX.Y.Z`, the highest existing patch of the line plus one
 - any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the line comes from `release_line`, the branch name, the nearest `release/*` or `hotfix/*` branch (newest merge base), or `major.minor` from `package.json`
 
 If the stable tag of a line exists (`v2.4.0` after the release), the next patch of that line is used (`v2.4.1-beta.0`, `v2.4.1-dev.…`).
 
-Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over. The same happens when the push is rejected because of a race: branch and tag are pushed atomically, so either both land or neither.
+Only the commit that triggered the pipeline is tagged; if the branch moved on, the step exits without a tag and the newer pipeline takes over. A commit that already carries a `v*` tag is not tagged again, so a re-run does not build twice.
 
 Settings:
 
@@ -188,7 +190,6 @@ Settings:
 - `git_user`: default `oumta-ci`
 - `release_branch`: optional, branch that gets stable tags instead of dev tags
 - `release_line`: optional, `<major>.<minor>[.<patch>]`, overrides every other rule
-- `author_name`, `author_email`: default `oumta-ci`, `oumta-ci@noreply.git.uesome.de`
 - `remote`: default `CI_REPO_CLONE_URL`
 
 Example:
@@ -201,7 +202,7 @@ when:
 
 steps:
   - name: bump
-    image: git.uesome.de/actions/ci-cd/bump:v1.0.0
+    image: git.uesome.de/actions/ci-cd/bump:v2.0.0
     settings:
       git_token:
         from_secret: oumta_ci_token