IONOS(ci): derive publish coordinate from ref and version (HDNEXT-2144)

[printminion-co]

• Resolves: nc-docs-and-tools#192 — first ticket of spec #190 (HDNEXT-2144)

Summary

Adds .github/scripts/derive-coordinate.sh: given a git ref and the NC_VERSION that was actually
built, it emits the tuple saying where that build belongs — lane, train, Nextcloud major, downstream
ref, chart path, chart version — or exits non-zero with a reason.

Nothing consumes it yet. Wiring it into the trigger and into the helm pipeline are separate,
later tickets. This PR delivers the unit and the proof that it behaves, so those tickets wire in
something already tested instead of growing more inline shell inside pipeline YAML.

Two properties it exists to hold:

• The major comes from the artifact, never from the branch name. Where a branch name declares a
  major, the declaration becomes an assertion that fails the build on disagreement. This is the
  guard that was missing on 2026-07-29, when an NC32 build successfully triggered the v30 lane and
  only an unrelated apk pin conflict stopped it.
• Every guard fails closed. An unrecognised ref, an empty or malformed NC_VERSION, or a
  declared major that disagrees with the artifact stops the pipeline. There is no default lane to
  fall back to.

Both branch naming eras are accepted indefinitely — legacy rc/web-3.5, whose trailing number is a
release counter rather than a major, and the new rc/web-v<major>-<n> shape. Unsuffixed ionos-dev
keeps working too: retiring it is a later step, and failing it closed here would break the live dev
build before that step arrives.

Two things found while implementing

Both contradict assumptions in the spec and are worth carrying into the later tickets:

• nc-server has no main branch — only master, the fork-sync branch, which is not a delivery
  lane and now fails closed. The trunk that publishes a chart line is main in the image and helm
  repos. The spec's "main becomes the integration trunk" step is about helm's main, not this repo's.
• ionos-dev-v32.0.6 has since been deleted from origin to keep a single dev-lane shape, so only
  ionos-dev-v<major> declares a major. A test pins the dotted form as unrecognised.

Review notes

• .github/scripts/tests/derive-coordinate.test.sh is a table of 48 cases, runnable offline with
  no pipeline, no registry and no network: every lane type, both naming eras, the 2026-07-29
  regression, and each fail-closed path. Every guard in the script is mutation-tested — deleting any
  one of them turns the table red.
• Neither a shell test harness nor shellcheck existed in this repo before, so both arrive here.
  shellcheck is deliberately scoped to the two new files rather than .github/scripts/**, because
  detect-app-cache.sh has 15 pre-existing findings that would block merges. The list should widen
  as those are cleaned up.
• This PR only puts the script on ionos-dev-v31. The other lanes need cherry-picks — which is
  the branch divergence that
  nc-docs-and-tools#193
  addresses.
• Opening this PR triggers hidrive-next-build, because .github/workflows/** is in that workflow's
  pull_request paths filter. Expected, not caused by this change.

Checklist

• Tests are included — 48 offline cases plus shellcheck, wired to run on pull requests
• Documentation not required — the script documents its own contract; the spec and ticket live in nc-docs-and-tools
• Screenshots before/after — not applicable, no front-end change
• Backports requested — not applicable; propagation to other lanes is tracked separately (see above)