CI on dev, the app started on X11 and Wayland; no silent re-release

ci.yml runs on dev too, adds the hygiene check, check-ui.sh (the modules parsed
as modules; nothing sets HTML) and the vendor pin, and a start job: a debug
build with the bundled page, started under Xvfb and under a headless Weston with
GTK's Wayland backend, which must still be running after 25 seconds.
release.yml refuses a tag that already has a release unless run by hand with
replace, marks betas as pre-releases, and gives a beta's .deb a ~beta version
so it sorts below its release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/check-ui.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# The page's JavaScript parses: the app's modules and the vendored ones as ES modules (a plain
+# `node --check file.js` treats a .js file as CommonJS and passes a module with a syntax error in
+# it), the generated i18n.js as the classic script it is.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+bad=0
+for f in ui/js/*.js ui/vendor/*.mjs; do
+  node --input-type=module --check < "$f" || { echo "check-ui: $f does not parse" >&2; bad=1; }
+done
+node --check ui/i18n.js || { echo "check-ui: ui/i18n.js does not parse" >&2; bad=1; }
+# Nothing the page draws is set as HTML: text goes in as text (ui/js/dom.js).
+if grep -nE '\.(innerHTML|outerHTML)\s*=|insertAdjacentHTML|document\.write' ui/js/*.js; then
+  echo "check-ui: the lines above set HTML from a string" >&2
+  bad=1
+fi
+[ "$bad" -eq 0 ] && echo "check-ui: the page's scripts parse, and none sets HTML"
+exit "$bad"