Builds and pushes to Gitea's container registry on push to main
("latest"/"previous", to avoid accumulating per-commit tags) and on
git tag push (tagged to match). Deployment is intentionally out of
scope here -- that work is being split into a separate project.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>