ci: only run on branch pushes; drop bump-script emerge; repoint vendor tags

- ci.yaml: filter the push trigger to branches. An unfiltered `push` also
  fired for every tag ref, including the vendor-release tags the bump script
  creates via the API.
- bump-version.sh: remove the pkgcheck/emerge/--version validation before
  push. The branch push triggers CI, which runs the same checks and, unlike
  the script's local copy, fetches the real release asset. The PR body now
  asks for green CI instead of claiming the build passed in the bump job.
- vendor-tags.yaml: new workflow on pushes to master touching dev-util/**.
  The vendor release is created before the bump commit exists (and PRs are
  squash-merged), so its tag pointed at an arbitrary master commit. This
  force-updates each vendor tag whose ebuild is in the tree to the master
  commit that added that ebuild. Tags are only ever updated, never deleted,
  since deleting a release's tag deletes the release and its assets.
- CLAUDE.md: document both changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/bump-version.sh

@@ -120,13 +120,10 @@ printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$WORK"
   > /etc/portage/repos.conf/azy5030.conf
 ( cd "${pkgdir}" && pkgdev manifest )
 
-# --- validate, commit, push, open PR ----------------------------------------
-pkgcheck scan --repo "$WORK" "${pkgdir}" || true
-mkdir -p /etc/portage/package.accept_keywords
-echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
-emerge -v --getbinpkg "=dev-util/${PN}-${latest}"
-gitea-runner --version | grep -q "v${latest}"
-
+# --- commit, push, open PR ---------------------------------------------------
+# No emerge/pkgcheck here: pushing the branch triggers CI, which runs pkgcheck,
+# builds the package from the Manifest (fetching the real release asset) and
+# asserts `gitea-runner --version`. A broken release shows up as a red PR.
 git add -A
 git commit -m "dev-util/${PN}: bump to ${latest}"
 git push origin "$branch"
@@ -141,8 +138,7 @@ Review checklist:
 - [ ] LICENSE still covers all vendored module licenses (\`go-licenses report ./...\`)
 - [ ] BDEPEND Go version matches upstream go.mod (set to >=${goreq:-unchanged})
 - [ ] version ldflags path \`internal/pkg/ver.version\` unchanged upstream
-
-CI build + \`gitea-runner --version\` passed in this workflow.
+- [ ] CI (pkgcheck + emerge + \`gitea-runner --version\`) is green on this PR
 EOF
 )
 api -X POST -H 'Content-Type: application/json' \