Retire the bugfix branch: every release is cut from dev

[Maffooch]

Description

Retires the bugfix branch. From 3.4.0 on, every release comes from dev: the weekly patch (x.y.100, x.y.200, ...) and the monthly minor (x.y.0) alike. The schedule stays the same. All PRs, bug fixes and features, target dev, and a merged PR ships in the next scheduled release.

Release workflows:

• release-1-create-pr.yml: from_branch now has one option, dev. The input stays so existing callers that pass -f from_branch=dev keep working. One version check accepts both x.y.0 and x.y.<1-3 digits>.
• release-3-master-into-dev.yml: the job that opened the master -> bugfix merge-back is removed. The chart version flow already works for every release: the release strips -dev, and the merge-back bumps the patch and adds -dev again.
• release_drafter_valentijn.yml: input help text only. The patch-range workaround existed because patches came from a separate branch.

CI and docs deploy:

• bugfix is dropped from the branch filters in unit-tests.yml, test-helm-chart.yml, ci-warm-caches.yml, migration-graph.yml, ruff.yml, detect-merge-conflicts.yaml and renovate.yaml.
• gh-pages.yml now deploys on pushes to master and dev, so docs go live when they merge. A concurrency group stops a master deploy and a dev deploy from racing.

Contributor docs:

• PR template, readme-docs/CONTRIBUTING.md and readme-docs/RELEASING.md describe the single branch.
• The branching model page and its 7 translations now show dev -> release/x.y.z -> master, with master merged back into dev. The dead workflow links now point at the real release-1/2/3 files. The translations were edited by hand and have not been checked by native speakers.
• AGENTS.md, the branch-guard hook and the two Claude skills now say all work goes to dev. The guard still blocks edits on master until someone confirms.

CI on release merges

Release PRs and merge-backs are now merged as soon as they are conflict-free, without waiting for CI, to save time and runner cost.

• Branch names: the release branches now follow the same naming as the other DefectDojo repositories. The release PR comes from release/merge-dev-into-master-<version> (was release/<version>), and the merge-back from release/merge-master-into-dev-<version> (was master-into-dev/<version>-<dev>).
• Pull request events: the test and lint workflows skip when the head starts with release/merge- AND the PR has the release-management label. Both conditions must hold. release-1 and release-3 already add that label.
• Push events: labels don't exist there, so ruff.yml and migration-graph.yml skip a push to such a branch, or GitHub's merge commit for such a PR.
• Unit Tests Complete now skips too, instead of failing, when its inputs were skipped this way.
• ci-warm-caches.yml still runs, since it only builds the cache that later PRs use.

Rollout

This should merge into dev before the 3.4.0 release (due 2026-10-05). Two things stay the same until then:

• The 3.4.0 release itself runs the current workflows from master, including the last bugfix -> dev merge. Its release PR is what carries these changes to master.
• The first release on the new flow is 3.4.100.

After 3.4.0, a maintainer needs to change some repository settings:

• Retarget open bugfix PRs to dev before rebasing them.
• Point the "Merge Queue" ruleset at dev.
• Drop bugfix from the "Branch Protection" ruleset.
• Once no PR targets bugfix, lock it, then delete it.

Checks

• actionlint passes on the edited workflows. With shellcheck enabled it reports the same info/style findings as before, minus three that went away with the deleted job.
• bash -n passes on the hook, and I ran the hook by hand in session, edit and commit modes against dev, a topic branch, and a detached HEAD at master.