ba4133bf5d
Push to main mints the next vX.Y.Z patch tag, builds and pushes a multi-arch image to the registry, and tags the repo. A manual bump-version workflow handles minor/major bumps. This workflow deliberately holds no deployment-repo credentials: the repo is public, so the GitOps side polls the registry and pulls new tags itself rather than being pushed to from here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>