One build per tag: Flatter emits both the channel repo and the Release bundles

Today a tag builds twice (bundle job in the Flathub container for GitHub Releases; flatter in its container for the Pages channel): same tagged source and manifest, functionally identical, but byte-cousins, ~25 min total, and the Release bundles are unsigned (sha256 only) while the repo is GPG-signed. Unify: flatter's upload-bundles output (signed, both arches) becomes the Release asset; the standalone bundle job retires. Halves tag CI time, makes channel and Release byte-identical, signs the bundles. Owner question that prompted it: 'is the flatpak in github releases the exact same (and signed now)?'