CI: check what npm receives, keep the tree stable, stop the VPS1 deploy

- pr-any: after each step the tree must be unchanged (yarn lint runs
  eslint --fix, yarn build rewrites packageInfo.ts), and after build
  scripts/check-built-manifests.py checks the package.json of each
  package in scripts/published-packages.txt: entry points exist, no
  ./build/ or ./cjs/cjs/ paths, no workspace: ranges.
- push-main bumped the patch version on every push, pushed that commit
  to main as a bot, and copied the zips as root to 37.60.230.9, a host
  that has been retired; js.pezkuwichain.io no longer serves them and
  the extension is distributed through the stores. It now builds,
  checks the manifests and keeps the Chrome and Firefox packages as
  artifacts of the commit. The version is set in the release PR.
- The auto-approve and auto-merge bots are removed.
- ff-diff/, the output of yarn diff, is ignored by git and eslint.

.github/workflows/pr-any.yml

@@ -21,3 +21,14 @@ jobs:
         corepack enable
         yarn install --immutable
         yarn ${{ matrix.step }}
+    # `yarn lint` runs eslint --fix and `yarn build` rewrites packageInfo.ts and
+    # the i18n catalogue, so both pass on a tree they changed. The committed
+    # tree must already be what they produce.
+    - name: tree unchanged
+      run: git diff --exit-code --stat
+    # The package.json each published package's build/ holds is what npm
+    # receives: entry points must exist, no ./build/ or ./cjs/cjs/ paths, no
+    # workspace: ranges (extension-base 0.62.19 went out with workspace:*).
+    - name: check built manifests
+      if: matrix.step == 'build'
+      run: python3 scripts/check-built-manifests.py . $(cat scripts/published-packages.txt)