Build-scan-promote pipeline: explicit trivy-scan, podman-promote, deploy-prod actions

- podman-build-publish: reverted to pure build+push (v8 behavior) — the
  Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
  HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
  promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
  BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
  standardized on public/actions.

Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

podman-build-publish/action.yaml

@@ -37,20 +37,6 @@ inputs:
       Set to "false" for build-only verification workflows.
     required: false
     default: "true"
-  scan:
-    description: |
-      Whether to scan the built image with Trivy before pushing. The step
-      fails — blocking the push — when vulnerabilities at or above the
-      configured severities with an available fix are found (unfixed CVEs
-      are ignored: nothing actionable, and Debian/Alpine bases always carry
-      some). Requires the trivy binary on the runner. Set to "false" only
-      with a documented reason.
-    required: false
-    default: "true"
-  scan-severity:
-    description: Comma-separated Trivy severities that fail the scan.
-    required: false
-    default: HIGH,CRITICAL
 
 runs:
   using: composite
@@ -155,46 +141,6 @@ runs:
         build_cmd+=("${{ inputs.context }}")
         "${build_cmd[@]}"
 
-    - if: ${{ inputs.scan != 'false' }}
-      id: scan
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        : "${PODMAN_STORAGE_DRIVER:=vfs}"
-        : "${PODMAN_STORAGE_OPT:=}"
-
-        podman_args=(
-          --root "${RUNNER_TEMP}/podman-root"
-          --runroot "${RUNNER_TEMP}/podman-runroot"
-          --storage-driver "${PODMAN_STORAGE_DRIVER}"
-        )
-
-        if [[ -n "${PODMAN_STORAGE_OPT}" ]]; then
-          podman_args+=(--storage-opt "${PODMAN_STORAGE_OPT}")
-        fi
-
-        image_base="registry.noctrl.eu/${{ inputs.image-name }}"
-        first_tag="$(printf '%s\n' "${{ inputs.tags }}" | tr ', ' '\n\n' | sed '/^$/d' | head -n1)"
-
-        # Trivy cannot read podman's storage under a custom --root, so scan
-        # an exported archive instead. Must be docker-archive: trivy's
-        # --input does not understand oci-archive tarballs (verified).
-        archive="${RUNNER_TEMP}/trivy-scan-image.tar"
-        rm -f "${archive}"
-        podman "${podman_args[@]}" save --format docker-archive -o "${archive}" "${image_base}:${first_tag}"
-
-        echo "Scanning ${image_base}:${first_tag} (fail on: ${{ inputs.scan-severity }}, fixed only)"
-        trivy image \
-          --input "${archive}" \
-          --scanners vuln \
-          --severity "${{ inputs.scan-severity }}" \
-          --ignore-unfixed \
-          --exit-code 1 \
-          --no-progress
-
-        rm -f "${archive}"
-
     - if: ${{ inputs.push != 'false' }}
       id: push
       shell: bash