Rework CI/CD into 3 pipelines: ci, deploy, scheduled-update

Split build.yaml into separate workflows for clearer separation of concerns:
- ci.yaml: PR builds push to staging tag (:pr-N), runs Trivy scan
- deploy.yaml: on merge retags staging to :latest + :version, on direct push runs full pipeline
- scheduled-update.yaml: daily cron checks for new upstream releases

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/build.yaml

@@ -1,75 +0,0 @@
-name: Build and Push
-
-on:
-  push:
-    branches: [master]
-    paths:
-      - .github/workflows/build.yaml
-      - build/**
-  pull_request:
-    paths:
-      - .github/workflows/build.yaml
-      - build/**
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  packages: write
-  security-events: write
-
-env:
-  IMAGE: ghcr.io/${{ github.repository_owner }}/protonmail-bridge
-
-jobs:
-  resolve-version:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.version.outputs.version }}
-    steps:
-      - name: Get latest upstream release
-        id: version
-        run: |
-          version=$(curl -s https://api.github.com/repos/ProtonMail/proton-bridge/releases/latest | jq -r '.tag_name')
-          echo "version=$version" >> $GITHUB_OUTPUT
-          echo "Resolved version: $version"
-
-  build:
-    needs: resolve-version
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        if: github.event_name != 'pull_request'
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build
-        uses: docker/build-push-action@v6
-        with:
-          context: ./build
-          push: ${{ github.event_name != 'pull_request' }}
-          load: ${{ github.event_name == 'pull_request' }}
-          tags: |
-            ${{ env.IMAGE }}:latest
-            ${{ env.IMAGE }}:${{ needs.resolve-version.outputs.version }}
-          build-args: |
-            version=${{ needs.resolve-version.outputs.version }}
-
-      - name: Trivy scan
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: ${{ env.IMAGE }}:${{ needs.resolve-version.outputs.version }}
-          format: sarif
-          output: trivy-results.sarif
-          severity: CRITICAL,HIGH
-
-      - name: Upload Trivy results
-        uses: github/codeql-action/upload-sarif@v3
-        if: always()
-        with:
-          sarif_file: trivy-results.sarif