ci: cut releases from a tag, with notes from CHANGELOG.md (#717)

Port of #715 and #716 to 2.x. Releases here were published by hand, so
the notes every install is offered were written at that moment rather
than reviewed with the change — 2.4.2's were composed at the point of
release, and nothing checked they existed or matched what shipped.

Tagging is now all that is required. release.yaml reads the CHANGELOG.md
section for the tag, builds via `make clean dist`, creates the release as
a draft with the package already attached, and publishes it as a separate
step. `release: published` therefore fires only once the tests have
passed and the asset is in place, so a failed run leaves no release at
all rather than a published one nobody can download — which is what
2.4.2 left behind. A tag with no section fails before anything is
published, and before any dependency is installed.

Because the asset is attached at publication, docker.yaml no longer needs
to build it: release_artifact_build is gone, and register_release loses
both that dependency and the always() dance it needed to survive the job
being skipped on a manual dispatch.

GitHub's "Latest release" pointer is gated on LATEST_MAJOR, the same
expression docker.yaml uses for its moving image tags.

The workflow is identical to 3.x's but for comments. tests.yaml carries
this branch's own test definition — xdebug coverage and a frontend build,
where 3.x runs in parallel and splits out module tests.

.github/workflows/tests.yaml

@@ -0,0 +1,51 @@
+name: Tests
+
+# Called by docker.yaml and release.yaml rather than written out in both. The
+# release artifact's file list already existed in two places on the 3.x branch
+# and drift was only a matter of time; the test definition should not repeat it.
+on:
+  workflow_call:
+
+jobs:
+  tests:
+    name: PHP Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php-version:
+          - 8.4
+    env:
+      extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup PHP Action
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          extensions: ${{ env.extensions }}
+          coverage: xdebug
+          tools: pecl, composer
+
+      - name: Install Composer dependencies
+        uses: ramsey/composer-install@4.0.0
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v6
+
+      - name: Use Node.js 24
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Compile Front-end
+        run: pnpm build
+
+      - name: Apply tests ${{ matrix.php-version }}
+        run: php artisan test