ci: only run on branch pushes; drop bump-script emerge; repoint vendor tags

- ci.yaml: filter the push trigger to branches. An unfiltered `push` also
  fired for every tag ref, including the vendor-release tags the bump script
  creates via the API.
- bump-version.sh: remove the pkgcheck/emerge/--version validation before
  push. The branch push triggers CI, which runs the same checks and, unlike
  the script's local copy, fetches the real release asset. The PR body now
  asks for green CI instead of claiming the build passed in the bump job.
- vendor-tags.yaml: new workflow on pushes to master touching dev-util/**.
  The vendor release is created before the bump commit exists (and PRs are
  squash-merged), so its tag pointed at an arbitrary master commit. This
  force-updates each vendor tag whose ebuild is in the tree to the master
  commit that added that ebuild. Tags are only ever updated, never deleted,
  since deleting a release's tag deletes the release and its assets.
- CLAUDE.md: document both changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

CLAUDE.md

@@ -52,8 +52,9 @@ re-uploaded as a release asset, or the build will fail Manifest verification. Th
 4. `git mv`s the ebuild to the new version, rewrites `BDEPEND`'s Go version from
    upstream `go.mod`, and regenerates the Manifest with `pkgdev manifest` (after copying
    both distfiles into `/var/cache/distfiles` and wiring a temporary `repos.conf`).
-5. Validates: `pkgcheck scan`, then `emerge` + `gitea-runner --version | grep v${ver}`.
-6. Commits, pushes the branch, opens a PR against `master`.
+5. Commits, pushes the branch, opens a PR against `master`. The script does **not**
+   emerge or pkgcheck the result itself: the branch push triggers CI, which does both
+   (and fetches the real release asset, which the script's local copy never would).
 
 Requires a `BUMP_TOKEN` repo secret (scopes: repository read/write, write release) plus
 a Gentoo env with `go pkgdev git curl xz jq`.
@@ -74,6 +75,17 @@ runner executes JS actions by `docker exec node …` *inside* the job container,
 `gentoo/stage3` ships no node, so any JS action fails with exit 127. The lint job has no
 `container:`, so it runs in the runner's default node-capable image and checkout works.
 
+## Vendor-tag repointing (`.gitea/workflows/vendor-tags.yaml`)
+
+The bump script creates the `${PN}-${ver}-vendor` release before the bump commit
+exists, so its tag points at whatever `master` was at the time (and squash/rebase
+merges mean the branch commit never lands on `master` anyway). On every push to
+`master` touching `dev-util/**`, this workflow force-updates each vendor tag whose
+ebuild is still in the tree to the `master` commit that added that ebuild. It only
+ever *updates* tags: deleting a release's tag makes Gitea delete the release and its
+assets, breaking the ebuild's `SRC_URI`. Tag pushes don't re-trigger CI because
+`ci.yaml` is filtered to branch pushes.
+
 ## Conventions / gotchas
 
 - **YAML** is linted by `.yamllint.yaml` (relaxed: line-length and document-start