CI on dev, the app started on X11 and Wayland; no silent re-release

ci.yml runs on dev too, adds the hygiene check, check-ui.sh (the modules parsed
as modules; nothing sets HTML) and the vendor pin, and a start job: a debug
build with the bundled page, started under Xvfb and under a headless Weston with
GTK's Wayland backend, which must still be running after 25 seconds.
release.yml refuses a tag that already has a release unless run by hand with
replace, marks betas as pre-releases, and gives a beta's .deb a ~beta version
so it sorts below its release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/hygiene.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# The repository is public: nothing in it may name the private estate it was written on.
+# The LLeMbas section rule ("everything public is current-state and estate-free"), as a check
+# that runs in CI on every push rather than a sentence somebody has to remember.
+#
+# Patterns are the kinds of thing that leak: a private domain, an internal `.lan` name, a
+# container number, a private address range, a machine's name. This file is the one place that
+# may spell them, and is skipped.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+patterns=(
+  'houmeres'
+  '\b[a-z0-9-]+\.lan\b'
+  '\bCT ?2[0-9]{2}\b'
+  '\b10\.0\.0\.[0-9]+'
+  '\b192\.168\.[0-9]+\.[0-9]+'
+  '\bgamebox\b'
+  '\bthor\b'
+)
+found=0
+for pattern in "${patterns[@]}"; do
+  if git ls-files -z | grep -zv '^scripts/hygiene.sh$' | xargs -0 grep -nIEi -- "$pattern" ; then
+    echo "hygiene: the lines above match /$pattern/" >&2
+    found=1
+  fi
+done
+[ "$found" -eq 0 ] && echo "hygiene: nothing private in the tracked files"
+exit "$found"