fix(bump): Release-Modell nach D8/D9, atomarer Push

- production/*: kein Bump, der Schritt bricht ab (W4, D9)
- main hat keine Release-Rolle mehr; stabile Tags nur über settings.release_branch
  (Patch-Bump, für Repos ohne Majors wie oumta-keyklo), ohne Commit-Message-Magie
- Linie für dev-Tags: nächster release/* oder hotfix/*-Branch nach jüngster Merge-Base,
  bei Gleichstand die niedrigere Linie
- existiert das stabile Tag der Linie, zählt der Patch hoch (v2.4.1-beta.0 nach v2.4.0)
- hotfix/X.Y ohne Patch wird abgelehnt
- Branch und Tag in einem atomaren Push, kein halber Zustand nach Teilerfolg
- README: Regeln, Einschränkung des Secrets, Paket-Schreibrecht in actions

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -120,7 +120,9 @@ jobs:
 
 ## Woodpecker plugins
 
-Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version.
+Plugins are Docker images built from `woodpecker/<name>/` by `.woodpecker/plugins.yaml`. A tag `<name>-vX.Y.Z` publishes `git.uesome.de/actions/ci-cd/<name>:vX.Y.Z`; pipelines pin that version. The push uses `oumta-ci` with the Woodpecker secret `oumta_ci_token`, so `oumta-ci` needs package write access in the org `actions`.
+
+The secret `oumta_ci_token` holds the one token `oumta-ci` writes with. Limit it in Woodpecker to the images `woodpeckerci/plugin-docker-buildx:6`, `git.uesome.de/actions/ci-cd/bump` and `git.uesome.de/actions/ci-cd/deploy` and to the events `push`, `tag` and `manual` (zugaenge.md in oumta-deploy).
 
 ### deploy
 
@@ -169,19 +171,23 @@ steps:
 
 ### bump
 
-Sets the version for the pushed branch in `package.json`, commits it as `update version: vX [skip ci]`, tags it and pushes branch and tag. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events.
+Sets the version for the pushed branch in `package.json`, commits it as `update version: vX.Y.Z [skip ci]`, tags it and pushes branch and tag in one atomic push. The tag event then starts the build; `[skip ci]` only suppresses push and pull_request events.
 
-- `main`: release from the commit message (`release/x.y[.z]`, `hotfix/x.y.z`), otherwise a patch bump
-- `release/*`, `hotfix/*`: next `vX.Y.Z-beta.N`
-- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the release line comes from `release_line`, the newest ancestor `release/*` branch, or `package.json`
+- `release/X.Y[.Z]`, `hotfix/X.Y.Z`: next `vX.Y.Z-beta.N` of that line (D8). A hotfix needs a patch number.
+- `production/*`: no bump, the step fails. A release is a retag of a beta image (D9).
+- the branch in `release_branch` (repos without majors, e.g. oumta-keyklo `main`): next free `vX.Y.Z`, a patch bump from `package.json`
+- any other branch: `vX.Y.Z-dev.<UTC timestamp>`; the line comes from `release_line`, the branch name, the nearest `release/*` or `hotfix/*` branch (newest merge base), or `major.minor` from `package.json`
 
-Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over.
+If the stable tag of a line exists (`v2.4.0` after the release), the next patch of that line is used (`v2.4.1-beta.0`, `v2.4.1-dev.…`).
+
+Only the commit that triggered the pipeline is bumped; if the branch moved on, the step exits without a bump and the newer pipeline takes over. The same happens when the push is rejected because of a race: branch and tag are pushed atomically, so either both land or neither.
 
 Settings:
 
-- `git_token` (required): token with write access to the repo (`oumta_ci_token`)
+- `git_token` (required): token of `oumta-ci` (`oumta_ci_token`), write access to the repo
 - `git_user`: default `oumta-ci`
-- `release_line`: optional, `<major>.<minor>[.<patch>]`
+- `release_branch`: optional, branch that gets stable tags instead of dev tags
+- `release_line`: optional, `<major>.<minor>[.<patch>]`, overrides every other rule
 - `author_name`, `author_email`: default `oumta-ci`, `oumta-ci@noreply.git.uesome.de`
 - `remote`: default `CI_REPO_CLONE_URL`
 
@@ -190,7 +196,7 @@ Example:
 ```yaml
 when:
   - event: push
-    branch: [develop, 'feature/**', 'release/**', 'hotfix/**']
+    branch: ['feature/**', 'release/**', 'hotfix/**']
   - event: manual
 
 steps: