CI: port breadhelp onto bread-ecosystem's shared Arch build container

Mirrors breadpad's proven pattern: ci/build.sh wraps bread-ecosystem's
shared ci/build.sh, pinned by commit sha in ci/bread-ecosystem.rev
(rev 147cfbbf96ae4b171027defa1130d2caddb934b1). No ci/deps.txt — the
shared image's gtk4/libadwaita/gtk4-layer-shell/graphene set already
covers breadhelp's dependency surface (no libadwaita or extra native
libs beyond those). dev-release.yml/rc-release.yml/release.yml now
build (and, in dev-release.yml, test) through ci/build.sh instead of
bare cargo on the runner; a new check.yml runs clippy+test on
feature/**/fix/** pushes as a fast pre-release signal.

.forgejo/workflows/dev-release.yml

@@ -19,10 +19,10 @@ jobs:
             "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
 
       - name: build
-        run: cd src && cargo build --release --locked
+        run: cd src && bash ci/build.sh cargo build --release --locked
 
       - name: test
-        run: cd src && cargo test --release --locked
+        run: cd src && bash ci/build.sh cargo test --release --locked
 
       - name: compute dev version
         run: |