Pushes to dev ran the tests and the security scan again for the open
dev -> main pull request, and rebuilt every installer. Tests, bandit
and actionlint now run once per commit: on the push to dev or on a
pull request into dev. Releases follow Faro: build everything side
by side, then publish only when every download is there, so a failed
build never leaves a half release on PyPI. Tags are made through the
API, since git pushing one is refused when a commit changes a
workflow.