ci: export VERSION for rc sign steps and drop unsafe tag path filters

RC sign steps read ${VERSION} from the environment, but prepare only set
it locally. Export it via GITHUB_ENV like dev-bakery.yml. Drop paths:
filters on tag-triggered rc workflows (they pointed at the old beta-*.yml
names and can skip an RC publish when the tag diff misses those paths);
the job if: contains -rc. is the real gate. Skip -rc. tags in package.yml
because PKGBUILD pkgver cannot contain a hyphen. Rebuild bakery on
bread-utils changes (path dependency).

.forgejo/workflows/package.yml

@@ -6,6 +6,9 @@ on:
 
 jobs:
   package:
+    # PKGBUILD pkgver cannot contain `-`; skip RC tags the same way
+    # release-bakery.yml does.
+    if: ${{ !contains(github.ref_name, '-rc.') }}
     runs-on: [self-hosted, hestia]
     container:
       image: archlinux:latest