Build-scan-promote pipeline: explicit trivy-scan, podman-promote, deploy-prod actions

- podman-build-publish: reverted to pure build+push (v8 behavior) — the
  Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
  HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
  promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
  BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
  standardized on public/actions.

Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

podman-promote/action.yaml

@@ -0,0 +1,52 @@
+name: Podman Promote
+description: >
+  Promote an existing image in registry.noctrl.eu by retagging it server-side
+  (skopeo copy within the same registry — blobs are reused, no rebuild, no
+  transfer). Works for single-arch images and multi-arch manifest lists alike.
+  Fails if the source tag does not exist; it never falls back to building.
+
+inputs:
+  image-name:
+    description: Repository/image name path, for example noctrl/gitea-runner
+    required: true
+  source-tag:
+    description: Existing tag to promote, for example sha-abc123
+    required: true
+  target-tag:
+    description: Tag to publish, for example v1.2.3
+    required: true
+  registry-username:
+    description: Registry username for login.
+    required: true
+  registry-password:
+    description: Registry password for login.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - id: promote
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        export REGISTRY_AUTH_FILE="${RUNNER_TEMP}/promote-auth.json"
+
+        if ! command -v skopeo >/dev/null 2>&1; then
+          echo "ERROR: skopeo not found on this runner (needs noctrl/gitea-runner >= v10)" >&2
+          exit 1
+        fi
+
+        image_base="registry.noctrl.eu/${{ inputs.image-name }}"
+        source_ref="docker://${image_base}:${{ inputs.source-tag }}"
+        target_ref="docker://${image_base}:${{ inputs.target-tag }}"
+
+        cleanup() { rm -f "${REGISTRY_AUTH_FILE}"; }
+        trap cleanup EXIT
+
+        echo "${{ inputs.registry-password }}" | skopeo login registry.noctrl.eu \
+          --username "${{ inputs.registry-username }}" --password-stdin
+
+        echo "Promoting ${source_ref} -> ${target_ref}"
+        # --all: copy every manifest of a multi-arch list, or the single image.
+        skopeo copy --all "${source_ref}" "${target_ref}"