ci: advance floating minor tag (vX.Y) on real releases

Publishes an additional floating vX.Y tag alongside the immutable vX.Y.Z
so `docker pull ...:vX.Y` fetches the newest patch. Skipped on --rebuild
of an older version so the float never rolls backward. Deploys still pin
vX.Y.Z; the cleanup reaper only targets three-part semver, so the float
is never eligible for deletion.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-and-publish.yml

@@ -1,7 +1,9 @@
 name: Build and Publish Container
 
 # Builds and publishes a multi-arch image on every push to main, minting the
-# next patch version from git tags (vX.Y.Z) and pushing the tag back.
+# next patch version from git tags (vX.Y.Z) and pushing the tag back. Real
+# releases also advance a floating minor tag (vX.Y -> newest patch) as a
+# pull convenience; deploys still pin the immutable vX.Y.Z.
 #
 # NOTE (public repo): unlike private app repos, this workflow deliberately has
 # NO step that pushes to the deployment (GitOps) repository and holds no
@@ -81,7 +83,14 @@ jobs:
 
       - name: Build and push multi-arch image
         run: |
-          IMAGE_REF="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}"
+          TAGS="-t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}"
+          # On real releases, also advance the floating minor tag (vX.Y) to this
+          # build so `docker pull ...:vX.Y` fetches the newest patch. Skipped on
+          # a --rebuild of an older version, which must not clobber the float.
+          if [ "${{ env.REBUILD }}" != "true" ]; then
+            MINOR_TAG=$(echo "${{ env.VERSION }}" | grep -oE '^v[0-9]+\.[0-9]+')
+            TAGS="${TAGS} -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${MINOR_TAG}"
+          fi
           docker buildx build \
             --platform linux/amd64,linux/arm64 \
             --build-arg VERSION="${{ env.VERSION }}" \
@@ -89,7 +98,7 @@ jobs:
             --build-arg BUILD_TIME="$(date -u '+%Y-%m-%d_%H:%M:%S_UTC')" \
             --no-cache \
             --provenance=false \
-            -t "$IMAGE_REF" \
+            ${TAGS} \
             --push \
             .
 
@@ -131,6 +140,8 @@ jobs:
             exit 0
           fi
 
+          # Only three-part semver (vX.Y.Z) is eligible for deletion; the
+          # floating minor tag (vX.Y) never matches, so it is never reaped.
           VERSIONS=$(printf '%s' "$BODY" \
             | grep -oE '"version":"v[0-9]+\.[0-9]+\.[0-9]+"' \
             | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' \