ci(16-06): split publish build and push into separate steps

- Separate 'Build and push' into 'Build production image' (build only) and 'Push image' steps
- Creates insertion point between build and push for hygiene assertions (Task 2)
- Preserves --target production, Dockerfile path, both tags, and root context
- WR-04 immutable-tag-first push ordering preserved in push step

.gitea/workflows/publish.yml

@@ -76,7 +76,7 @@ jobs:
 
       # Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest +
       # lockfile from the root context; building from apps/api/ would fail to find them.
-      - name: Build and push
+      - name: Build production image
         run: |
           set -euo pipefail
           docker build --target production \
@@ -84,11 +84,15 @@ jobs:
             -t ${{ steps.tags.outputs.latest }} \
             -t ${{ steps.tags.outputs.sha_tag }} \
             .
+
       # Push the IMMUTABLE :<milestone>-<sha> tag FIRST. set -euo pipefail stops on
       # the first failed push, so :latest is only moved after the immutable,
       # rollback-traceable tag has landed — a failed second push can never leave
       # :latest advanced without a corresponding rollback tag (WR-04).
-          docker push ${{ steps.tags.outputs.sha_tag }}   # immutable first
+      - name: Push image
+        run: |
+          set -euo pipefail
+          docker push ${{ steps.tags.outputs.sha_tag }}   # immutable first (WR-04)
           docker push ${{ steps.tags.outputs.latest }}    # move pointer only after immutable lands
 
       # Always drop the stored credential from the runner after push (defence in depth).