ci: publish a snapshot on every push to main

[rasros]

Summary

A push to main publishes a snapshot of the next patch version. Tags still publish releases.

Why

Requiring a -SNAPSHOT tag was the first attempt at this and it was wrong; kbuild moved off it and
this brings the rest into line. The snapshot step here was gated on the version containing a hyphen
while the only trigger was tags, so it could only fire for a -SNAPSHOT tag, which nobody creates.
The result is that this library has never published a snapshot at all: its metadata is a 404 on the
snapshot repository, while kbuild has four versions there.

That matters because consumers cannot pick up a library change until it is released. kbuild uses its
own snapshots to verify convention changes across six repos before tagging, and the same argument
applies to any library klause consumes.

Shape, matching kbuild

• branches: [main] alongside the tag trigger, plus a dryRun dispatch input that runs the release
  build and publishes nothing.
• Version comes from next_patch, derived from the newest release tag, so a prerelease tag does not
  advance the snapshot line. Checkout needs fetch-depth: 0 to see the tags.
• A concurrency group cancels superseded snapshot runs but never a tag publish.
• Snapshots skip the test run, the GitHub Release and the prerelease detection, because build.yml
  already tests the same commit on a main push and a snapshot is not a release.

Testing

The workflow parses, and the version derivation was simulated against the real tag list here.

Not included

The release job still uses plain setup-java rather than gradle/actions/setup-gradle, so it does
not read the caches build.yml writes. That mattered little when the job ran on tags alone; now that
it runs on every merge it is worth doing, as a separate change.