ci: release dev merges through Actions

[Arbousier1]

What changed

• run Build and Test on dev pushes and on PRs targeting dev or main
• release only after a same-repository dev PR is actually merged into main
• preflight version, changelog, source SHA, and remote tag collisions before the platform matrix
• build every platform from the exact merge commit, then create an annotated tag and publish the universal jar
• queue releases, keep build jobs read-only, and grant write permission only to the final release job
• keep routine Dependabot updates targeting dev
• prepare the next release as 1.5.0 without moving the existing v1.4.1 tag

Why

dev remains the integration branch while main becomes the default release branch. The old tag-driven workflow assumed a tag already existed and tried to move main afterward, so it could not safely publish from a dev to main merge.

Validation

• git diff --check
• two independent read-only reviews of trigger semantics, tag provenance, permissions, concurrency, and first-release ordering
• no local Gradle build or tests, per project policy; GitHub Actions is the validation gate