docs(260611-ozt): document release model in README Publishing/Releases section

- Add Publishing / Releases section covering auto-trigger, image tags,
  REGISTRY_PAT secret naming, branch-protection safety gate, and MILESTONE bump
- publish.yml already carries condensed header block (committed in prior task)

README.md

@@ -122,6 +122,22 @@ Store the app password in the database via the `/me` endpoint after first login.
 
 See [`docs/deployment.md`](docs/deployment.md) for Unraid/Docker Compose deployment notes including the Pangolin/Newt tunnel configuration.
 
+## Publishing / Releases
+
+Publishing happens automatically on every push to `main` — i.e. when a PR merges. The `.gitea/workflows/publish.yml` workflow runs and builds + pushes the API image to the Gitea container registry.
+
+**Image:** `git.bergerhouse.net/luckberg/familysync-api`
+
+**Tags (two per release):**
+- `:latest` — moving pointer for easy pulls
+- `:<MILESTONE>-<shortsha>` — immutable, rollback-traceable (e.g. `v1.1-98acff8`)
+
+**Required secret:** `REGISTRY_PAT` — a Gitea Actions secret holding a PAT with `write:package` scope. Named `REGISTRY_PAT` (not `GITEA_*`): Gitea reserves the `GITEA_` prefix for secret names, so `GITEA_`-prefixed names cannot be created. `GITEA_TOKEN` / `GITHUB_TOKEN` cannot push packages.
+
+**Safety gate:** Branch protection on `main`, not a `needs:` dependency in `publish.yml`. The PR test jobs (`fast-checks`, `api`, `harness` in `ci.yml`) run on `pull_request` — they never run in the same workflow invocation as `publish.yml`. Tests gate the PR; `main` is trusted to be green because direct push and force push are blocked and the three required checks (`CI / fast-checks (pull_request)`, `CI / api (pull_request)`, `CI / harness (pull_request)`) must pass before merge.
+
+**To bump the milestone tag** at a milestone boundary: edit the `MILESTONE` env value at the top of `.gitea/workflows/publish.yml`.
+
 ## License
 
 Private — not open source.