ci: merge version check into plugin-checks, share packaging as a composite action

- one PR workflow (plugin-checks) with version-changelog, package, phpunit jobs
- .gitea/actions/package: package + validate + assert, used by PR and release
- phpunit: FORCE_INSTALL so the TestBootstrapper installs its own test DB
- protect-main.sh: required context is now plugin-checks / version-changelog

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/protect-main.sh

@@ -9,7 +9,7 @@ REPO="${1:-$(git config --get remote.origin.url | sed -E 's#^.*[:/]([^/]+/[^/]+)
 tea api -X PATCH "repos/${REPO}/branch_protections/main" -d '{
   "enable_status_check": true,
   "status_check_contexts": [
-    "version-changelog / version-changelog (pull_request)",
+    "plugin-checks / version-changelog (pull_request)",
     "plugin-checks / package (pull_request)",
     "plugin-checks / phpunit (pull_request)"
   ]