ci: clean-deploy on tag and skip redundant verify

The two-step 'mvn verify' then 'mvn deploy -Prelease -DskipTests' on
tag pushes leaves unsigned outputs in target/ from step 1; step 2
re-enters the lifecycle without a clean, which can leave artifact
bytes out of sync with the .asc files produced by gpg:sign.

beast3's multi-module build has no maven-assembly-plugin, so the jar/
sources/javadoc artifacts have been deterministic enough that
v2.8.0-beta5 published successfully. The bug is latent and caused
v1.3.0-beta1 of FLC to fail with 'Invalid signature' on the assembly
zip and the sources and javadoc jars. Fix preventively here.

Changes:
- gate 'Build and test' to non-tag pushes (the deploy step now runs
  the full lifecycle including tests)
- replace 'mvn deploy -Prelease -DskipTests' with 'mvn -Prelease clean
  deploy' so the release runs from a clean target/

The master-push GitHub Packages deploy is unchanged: snapshots are
unsigned, so byte-mismatch is not a concern there.

Author: alexeid

.github/workflows/ci-publish.yml

@@ -51,6 +51,7 @@ jobs:
           mvn versions:set -DnewVersion=$VERSION -DgenerateBackupPoms=false
 
       - name: Build and test
+        if: "!startsWith(github.ref, 'refs/tags/v')"
         run: mvn verify
 
       - name: Deploy all modules to GitHub Packages
@@ -61,7 +62,7 @@ jobs:
 
       - name: Publish to Maven Central
         if: startsWith(github.ref, 'refs/tags/v')
-        run: mvn deploy -Prelease -DskipTests
+        run: mvn -Prelease clean deploy
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}