CI: a push runs the tests, a pull request also builds the firmware

Rebuilding both firmwares on every push was more than anyone looked at.
A push now runs the host tests with their coverage (under two minutes);
a pull request adds the release firmware and the Debug Build, and is how
changes reach main; a tag still does everything before it releases.
Pull requests from forks don't run. scripts/ci.sh takes 'tests' or
'builds' for one half; coverage.sh now fails when a test fails.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

scripts/coverage.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# How much of lib/ the host tests run: builds them with coverage counters, runs them, and reports.
+# Runs the host tests and says how much of lib/ they run: they're built with coverage counters.
 # Usage: scripts/coverage.sh [out folder, default .pio/coverage]
 # Out: summary.json (gcovr), coverage.svg (the README's badge), index.html (line by line).
 # What it measures: the lines of lib/ that compile on a PC. Not lib/SD (the card's driver) and not
@@ -10,7 +10,7 @@ DOCKER_EXTRA=()
 OUT="${1:-.pio/coverage}"
 
 run_in_container bash -c '
-    set -e
+    set -eo pipefail  # a failing test fails this script, tail or not
     git config --global --add safe.directory "$PWD"
     rm -rf .pio/build/native-coverage "'"$OUT"'"
     mkdir -p "'"$OUT"'"