ci: restore branch gates and make changelog a downloadable artifact

- Restore if-guards on build-and-push (main/release/* only)
- Replace changelog commit-and-push with upload-artifact
- Add if-guard back on changelog job

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -103,6 +103,9 @@ jobs:
     name: Build & Push Image
     runs-on: docker
     needs: [test]
+    if: >-
+      github.event_name == 'push' &&
+      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
     steps:
       - name: Checkout
         run: |
@@ -147,6 +150,9 @@ jobs:
     name: Changelog
     runs-on: docker
     needs: [test]
+    if: >-
+      github.event_name == 'push' &&
+      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
     container:
       image: rust:1.89-bookworm
     steps:
@@ -158,14 +164,8 @@ jobs:
         run: cargo install git-cliff --locked
       - name: Generate changelog
         run: git cliff --output CHANGELOG.md
-      - name: Commit and push changelog
-        run: |
-          git config user.name "CI Bot"
-          git config user.email "ci@certifai.local"
-          git add CHANGELOG.md
-          if git diff --cached --quiet; then
-            echo "No changelog changes to commit"
-          else
-            git commit -m "docs: update CHANGELOG.md [skip ci]"
-            git push origin HEAD:"${GITHUB_REF_NAME}"
-          fi
+      - name: Upload changelog artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: changelog
+          path: CHANGELOG.md