Eliminate double towncrier run in release workflow (#199)

## Summary

- Added a new `build_quartz` Dagger function that builds the Quartz site from a pre-processed source tree (no towncrier)
- Reordered the release workflow so towncrier runs **once** on the runner, then passes the updated working tree to `build-quartz`
- `build_docs` and `build_changelog` are preserved for standalone use — `build_docs` now delegates to `build_quartz` internally

## Motivation

Previously towncrier ran twice per release: once inside a Dagger container (via `build_docs` → `build_changelog`) and once on the runner to capture CHANGELOG.md changes for the git commit. This was wasteful and fragile — if towncrier behavior changed, the two runs could produce different results.

## Test plan

- [ ] Review diff to confirm workflow step ordering is correct
- [ ] Trigger a release and confirm towncrier runs only once
- [ ] Verify the docs tarball contains the updated CHANGELOG.md
- [ ] `dagger call build-quartz --src=. --version=vX.Y.Z` should work standalone

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/199

.forgejo/workflows/build-blumeops.yaml

@@ -108,30 +108,14 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Build docs
-        run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          TARBALL="docs-${VERSION}.tar.gz"
-          echo "Building docs via Dagger..."
-          # build-docs calls build_changelog internally (towncrier runs inside
-          # the Dagger container). The host working tree is not modified — only
-          # the tarball is exported. Towncrier runs a second time on the runner
-          # in the next step so that CHANGELOG.md and fragment deletion are
-          # captured in the git commit.
-          dagger call build-docs --src=. --version="$VERSION" \
-            export --path="./$TARBALL"
-          echo "Build complete!"
-          ls -lh "$TARBALL"
-
       - name: Build changelog
         id: changelog
         run: |
           VERSION="${{ steps.version.outputs.version }}"
 
-          # Run towncrier on the runner (not in Dagger) so that CHANGELOG.md
-          # updates and fragment deletions appear in the working tree for the
-          # git commit step. This is intentionally a second towncrier run —
-          # the first happened inside the Dagger build-docs container above.
+          # Run towncrier on the runner so that CHANGELOG.md updates and
+          # fragment deletions appear in the working tree for both the Quartz
+          # build (next step) and the git commit step.
           # Check if there are any changelog fragments
           FRAGMENTS=$(find docs/changelog.d -name "*.md" -not -name ".gitkeep" 2>/dev/null | wc -l)
 
@@ -157,6 +141,19 @@ jobs:
             echo "" > /tmp/release_notes.md
           fi
 
+      - name: Build docs
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          TARBALL="docs-${VERSION}.tar.gz"
+          echo "Building docs via Dagger..."
+          # Towncrier already ran on the runner above, so the working tree
+          # has an up-to-date CHANGELOG.md. build-docs now only runs the
+          # Quartz static site build (no towncrier).
+          dagger call build-docs --src=. --version="$VERSION" \
+            export --path="./$TARBALL"
+          echo "Build complete!"
+          ls -lh "$TARBALL"
+
       - name: Create release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}