ci: plugin-agnostic PR checks and package-then-release pipeline

- plugin-checks workflow: shopware-cli validate, package + built-JS assertion, phpunit
- release: validate, package from the merge commit, validate the zip, create the release
  via the Gitea API, publish the same zip to the Composer registry
- scripts/protect-main.sh sets required status checks via tea api
- bump to 0.1.0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/protect-main.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# One-time (re-runnable) setup: require the PR checks on `main` using the Gitea `tea` CLI.
+# `tea branches protect` cannot set status-check contexts, hence `tea api`.
+# Usage: scripts/protect-main.sh [owner/repo]   (default: derived from the git remote)
+set -euo pipefail
+
+REPO="${1:-$(git config --get remote.origin.url | sed -E 's#^.*[:/]([^/]+/[^/]+)$#\1#; s#\.git$##')}"
+
+tea api -X PATCH "repos/${REPO}/branch_protections/main" -d '{
+  "enable_status_check": true,
+  "status_check_contexts": [
+    "version-changelog / version-changelog (pull_request)",
+    "plugin-checks / validate (pull_request)",
+    "plugin-checks / package (pull_request)",
+    "plugin-checks / phpunit (pull_request)"
+  ]
+}'