chore(260611-ozt): split publish job into standalone publish.yml

- Create .gitea/workflows/publish.yml (push-to-main only, name=Publish)
- Strip publish job, push trigger, and MILESTONE env from ci.yml
- Eliminates orphaned CI / publish (pull_request) status on PRs
- Preserves all three required PR status contexts unchanged

.gitea/workflows/ci.yml

@@ -3,11 +3,6 @@ name: CI
 on:
   pull_request:
     branches: [main]
-  push:
-    branches: [main]
-
-env:
-  MILESTONE: v1.1
 
 jobs:
   fast-checks:
@@ -310,53 +305,3 @@ jobs:
           name: playwright-traces-${{ github.run_id }}
           path: apps/pwa/test-results/
           retention-days: 14
-
-  publish:
-    runs-on: ubuntu-latest
-    # Push to main only — never on pull_request (D-03). No dev-bypass flag in this job (T-08-09).
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    steps:
-      - uses: actions/checkout@v4
-
-      # Compute both image tags per D-04:
-      #   :latest        — moving pointer for easy pulls
-      #   :<milestone>-<shortsha> — immutable, rollback-traceable (e.g. v1.1-4303a1b)
-      # GITHUB_SHA is confirmed available in Gitea Actions (probe P-13).
-      # MILESTONE is read from the workflow-level env var (set to v1.1 above) — update at milestone boundaries.
-      - name: Compute image tags
-        id: tags
-        run: |
-          SHORT_SHA=${GITHUB_SHA:0:7}
-          MILESTONE="${{ env.MILESTONE }}"
-          echo "latest=git.bergerhouse.net/luckberg/familysync-api:latest" >> $GITHUB_OUTPUT
-          echo "sha_tag=git.bergerhouse.net/luckberg/familysync-api:${MILESTONE}-${SHORT_SHA}" >> $GITHUB_OUTPUT
-
-      # Pitfall 13 (load-bearing security step): PAT piped via stdin — never via -p/--password.
-      # GITEA_TOKEN/GITHUB_TOKEN cannot push packages; a PAT with write:package scope is required
-      # (confirmed: Gitea forum + registry docs). Token is masked by Gitea's secret-log scrubber
-      # and never echoed elsewhere or set as a plain env var.
-      # Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix
-      # for secret names, so the GITEA_-prefixed name cannot be created.
-      - name: Docker login
-        run: |
-          echo "${{ secrets.REGISTRY_PAT }}" | \
-          docker login git.bergerhouse.net \
-            --username luckberg \
-            --password-stdin
-
-      # Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
-      # lockfile from the root context; building from apps/api/ would fail to find them.
-      - name: Build and push
-        run: |
-          docker build --target production \
-            -f apps/api/Dockerfile \
-            -t ${{ steps.tags.outputs.latest }} \
-            -t ${{ steps.tags.outputs.sha_tag }} \
-            .
-          docker push ${{ steps.tags.outputs.latest }}
-          docker push ${{ steps.tags.outputs.sha_tag }}
-
-      # Always drop the stored credential from the runner after push (defence in depth).
-      - name: Docker logout
-        if: always()
-        run: docker logout git.bergerhouse.net || true