ci: export VERSION for rc sign steps and drop unsafe tag path filters

RC sign steps read ${VERSION} from the environment, but prepare only set
it locally. Export it via GITHUB_ENV like dev-bakery.yml. Drop paths:
filters on tag-triggered rc workflows (they pointed at the old beta-*.yml
names and can skip an RC publish when the tag diff misses those paths);
the job if: contains -rc. is the real gate. Skip -rc. tags in package.yml
because PKGBUILD pkgver cannot contain a hyphen. Rebuild bakery on
bread-utils changes (path dependency).

.forgejo/workflows/dev-bakery.yml

@@ -8,6 +8,7 @@ on:
     branches: ['main']
     paths:
       - 'bakery/**'
+      - 'bread-utils/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
       - '.forgejo/workflows/dev-bakery.yml'

.forgejo/workflows/package.yml

@@ -6,6 +6,9 @@ on:
 
 jobs:
   package:
+    # PKGBUILD pkgver cannot contain `-`; skip RC tags the same way
+    # release-bakery.yml does.
+    if: ${{ !contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     container:
       image: archlinux:latest

.forgejo/workflows/rc-bakery.yml

@@ -7,11 +7,9 @@ name: beta (rc) bakery
 on:
   push:
     tags: ['v*']
-    paths:
-      - 'bakery/**'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - '.forgejo/workflows/beta-bakery.yml'
+    # No paths: filter. Tag pushes compare against an unrelated commit and
+    # would skip the RC publish if bakery/** wasn't in that diff; the job
+    # `if: contains -rc.` is the real gate.
 
 jobs:
   build:
@@ -35,6 +33,7 @@ jobs:
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           PKG_DIR="/srv/breadway-dl/beta/bakery/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bakery" "${PKG_DIR}/bakery-x86_64"

.forgejo/workflows/rc-bread-theme.yml

@@ -7,11 +7,9 @@ name: beta (rc) bread-theme
 on:
   push:
     tags: ['v*']
-    paths:
-      - 'bread-theme/**'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - '.forgejo/workflows/beta-bread-theme.yml'
+    # No paths: filter. Tag pushes compare against an unrelated commit and
+    # would skip the RC publish if bread-theme/** wasn't in that diff; the
+    # job `if: contains -rc.` is the real gate.
 
 jobs:
   build:
@@ -32,6 +30,7 @@ jobs:
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
           PKG_DIR="/srv/breadway-dl/beta/bread-theme/${VERSION}"
           mkdir -p "${PKG_DIR}"
           cp "src/target/release/bread-theme" "${PKG_DIR}/bread-theme-x86_64"