ci: let PRO own the version name and split artifacts by branch [version set]

Three related fixes to the release plumbing:

- Only PRO bumps the semver now. main was bumping its patch on every push,
  so it raced permanently ahead of the branch that actually ships (main hit
  1.3.3 while PRO sat at 1.3.0), buried release artifacts under a dev branch
  on the portal, and made every main<->PRO merge conflict on pubspec.yaml.
  The build number still advances on every branch, since Play requires it to
  be monotonic across the whole app.

- The [version set] marker is now searched across every commit the push
  introduced, not just the tip. A plain 'git pull' inserts a merge commit
  with no marker, which silently dropped a pinned name and turned 1.3.0
  into 1.3.1.

- Artifacts land in a per-branch folder so the portal stops interleaving
  development and release builds.

.gitea/workflows/build.yml

@@ -68,7 +68,18 @@ jobs:
           echo "keyPassword=$KEYSTORE_PASSWORD" >> android/key.properties
           echo "✅ Keystore configurado"
 
-      - name: Bump versión patch + commit
+      # PRO owns the version NAME; every branch advances the build NUMBER.
+      #
+      # Previously main also bumped its patch on every push, so main's semver
+      # raced permanently ahead of PRO's (main hit 1.3.3 while the branch that
+      # actually ships sat at 1.3.0). That buried the release artifacts under a
+      # dev branch on builds.freetimelab.es, which sorts by version, and made
+      # every main<->PRO merge conflict on pubspec.yaml.
+      #
+      # The build number still advances everywhere: Google Play requires it to
+      # be monotonic across the whole app, so two branches must never mint the
+      # same code.
+      - name: Bump versión + commit
         run: |
           BRANCH="${CURRENT_REF#refs/heads/}"
           git config user.name "ShanaiaBot"
@@ -77,12 +88,20 @@ jobs:
           SEMVER=$(echo "$CURRENT" | cut -d'+' -f1)
           BUILD=$(echo "$CURRENT" | cut -d'+' -f2)
           NEW_BUILD=$((BUILD + 1))
-          # If the triggering commit explicitly pins the version name via the
-          # [version set] marker, ship that semver as-is (a milestone like 1.0.0
-          # or a major/minor jump the automatic patch bump cannot reach) and only
-          # advance the build number, which Google Play requires to stay
-          # monotonic. Otherwise keep the default automatic patch+build bump.
-          if git log -1 --pretty=%B | grep -q '\[version set\]'; then
+
+          # Look for [version set] across EVERY commit this push introduced,
+          # not just the tip. `git pull` inserts an auto-generated merge commit
+          # whose message carries no marker, which silently discarded a pinned
+          # version name and bumped 1.3.0 to 1.3.1 behind our backs.
+          RANGO="${{ gitea.event.before }}..${{ gitea.sha }}"
+          if git log "$RANGO" --pretty=%B 2>/dev/null | grep -q '\[version set\]'; then
+            MARCADOR="si"
+          else
+            MARCADOR="no"
+          fi
+
+          if [ "$BRANCH" != "PRO" ] || [ "$MARCADOR" = "si" ]; then
+            # Non-release branches never touch the name; PRO respects a pin.
             NEW_VERSION="${SEMVER}+${NEW_BUILD}"
           else
             MAJOR=$(echo "$SEMVER" | cut -d. -f1)
@@ -91,6 +110,8 @@ jobs:
             NEW_PATCH=$((PATCH + 1))
             NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}+${NEW_BUILD}"
           fi
+
+          echo "rama=${BRANCH} marcador=${MARCADOR} ${CURRENT} -> ${NEW_VERSION}"
           sed -i '' "s/^version: .*/version: ${NEW_VERSION}/" pubspec.yaml
           git add pubspec.yaml
           git commit -m "chore: bump version to ${NEW_VERSION} [ci skip]"
@@ -255,7 +276,10 @@ jobs:
           ETIQUETA="${BRANCH}-v${VERSION}+${BUILD_NUMBER}"
           APK_NOMBRE="pluriwave-${ETIQUETA}.apk"
           AAB_NOMBRE="pluriwave-${ETIQUETA}.aab"
-          DESTINO="/opt/ftl-builds/builds/pluriwave/v${VERSION}"
+          # Carpeta por rama: main y PRO ya no se mezclan en el portal, que
+          # ordena por número de versión y por tanto mostraba el build de
+          # desarrollo como "última versión" por delante del de release.
+          DESTINO="/opt/ftl-builds/builds/pluriwave/${BRANCH}/v${VERSION}"
           SSH_KEY="/Users/freetlab/.openclaw/workspace/.secure/zimaboard_ed25519"
 
           ssh -i "$SSH_KEY" -o StrictHostKeyChecking=no ShanaiaBot@192.168.0.33 "mkdir -p ${DESTINO}"