Build-scan-promote pipeline: explicit trivy-scan, podman-promote, deploy-prod actions

- podman-build-publish: reverted to pure build+push (v8 behavior) — the
  Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
  HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
  promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
  BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
  standardized on public/actions.

Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

deploy-prod/action.yaml

@@ -0,0 +1,66 @@
+name: Deploy Prod
+description: >
+  Deploy a commit of a *.podman infrastructure repo on its production host.
+  Runs on that host's dedicated deploy runner (gitea-runner-deploy image):
+  installs the deployment SSH key, reads the mounted deploy-target env file,
+  and pipes the runner image's deploy-prod.sh to the host over SSH. Host key
+  verification uses the known_hosts file mounted into the deploy runner.
+
+inputs:
+  deploy-target-file:
+    description: >
+      Path of the mounted deploy target env file, for example
+      /run/noctrl/prod-deploy-target.env. Must define REPO_DIR, PROD_HOST,
+      PROD_USER, PROD_PORT.
+    required: true
+  ssh-key-b64:
+    description: Base64-encoded private SSH deploy key (PROD_DEPLOY_SSH_KEY secret).
+    required: true
+  target-sha:
+    description: Commit SHA to deploy (normally github.sha).
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - id: install-key
+      shell: bash
+      env:
+        SSH_KEY_B64: ${{ inputs.ssh-key-b64 }}
+      run: |
+        set -euo pipefail
+        : "${SSH_KEY_B64:?missing ssh-key-b64 input (PROD_DEPLOY_SSH_KEY secret)}"
+        install -d -m 0700 ~/.ssh
+        printf '%s' "${SSH_KEY_B64}" | base64 -d > ~/.ssh/id_ed25519
+        chmod 0600 ~/.ssh/id_ed25519
+        ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null
+
+    - id: deploy
+      shell: bash
+      env:
+        TARGET_SHA: ${{ inputs.target-sha }}
+        DEPLOY_TARGET_FILE: ${{ inputs.deploy-target-file }}
+      run: |
+        set -euo pipefail
+
+        if [[ ! -f "${DEPLOY_TARGET_FILE}" ]]; then
+          echo "missing mounted deploy target file: ${DEPLOY_TARGET_FILE}" >&2
+          exit 1
+        fi
+
+        set -a
+        . "${DEPLOY_TARGET_FILE}"
+        set +a
+
+        : "${REPO_DIR:?missing REPO_DIR in ${DEPLOY_TARGET_FILE}}"
+        : "${PROD_HOST:?missing PROD_HOST in ${DEPLOY_TARGET_FILE}}"
+        : "${PROD_USER:?missing PROD_USER in ${DEPLOY_TARGET_FILE}}"
+        : "${PROD_PORT:?missing PROD_PORT in ${DEPLOY_TARGET_FILE}}"
+
+        ssh \
+          -o BatchMode=yes \
+          -o IdentitiesOnly=yes \
+          -i ~/.ssh/id_ed25519 \
+          -p "${PROD_PORT}" "${PROD_USER}@${PROD_HOST}" \
+          "REPO_DIR='${REPO_DIR}' bash -s -- '${TARGET_SHA}'" \
+          < /usr/local/bin/deploy-prod.sh