CI runs go vet/build/test plus govulncheck on PRs. Build pushes a
latest/previous image to the Gitea registry on push to main, and
Release pushes a tag-matched image on git tags. Adapted from the
project-manager workflows.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
