Stop upgrade-search from queuing mid-confidence matches that approve
cannot honor (owned movies/episodes 409'd on the TUI). De-dupe pending
review rows, scope 1080p gates to the target episode, refuse unsafe
pack cleanup, and require a token for non-loopback binds.
Adds ci/build.sh + ci/bread-ecosystem.rev (pinned to bread-ecosystem
147cfbbf96ae4b171027defa1130d2caddb934b1), points the three release
workflows' build step through it, and adds check.yml as breadarr's first
lint/test gate on feature/fix branches. No ci/deps.txt: verified ort-sys's
build.rs has no system build-time requirements beyond rust/base-devel
(its download-binaries feature is pure-Rust ureq/lzma-rust2/hmac-sha256).
