ci: clean-deploy on tag and skip redundant verify

The two-step 'mvn verify' then 'mvn deploy -Prelease -DskipTests' on
tag pushes leaves unsigned package outputs in target/ from step 1;
step 2 re-enters the lifecycle without a clean, leaving artifact
bytes out of sync with the .asc files produced by gpg:sign.

Caused FLC v1.3.0-beta1 to fail Sonatype publish with 'Invalid
signature' on the assembly zip and the sources and javadoc jars.
Same fix verified on CompEvol/morph-models v1.3.0-beta3.

Changes:
- gate 'Build and test' to non-tag pushes
- replace 'mvn deploy -Prelease -DskipTests' with 'mvn -Prelease clean
  deploy' so the release runs from a clean target/

Author: alexeid

.github/workflows/ci-publish.yml

@@ -44,11 +44,12 @@ jobs:
           mvn versions:set -DnewVersion=$VERSION -DgenerateBackupPoms=false
 
       - name: Build and test
+        if: "!startsWith(github.ref, 'refs/tags/v')"
         run: mvn verify
 
       - name: Publish to Maven Central
         if: startsWith(github.ref, 'refs/tags/v')
-        run: mvn deploy -Prelease -DskipTests
+        run: mvn -Prelease clean deploy
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}