Build-scan-promote pipeline: explicit trivy-scan, podman-promote, deploy-prod actions

- podman-build-publish: reverted to pure build+push (v8 behavior) — the
  Trivy gate briefly embedded in v10 moves to an explicit action instead.
- trivy-scan (new): scans a registry image ref, fails on fixable
  HIGH/CRITICAL findings; jobs pin it to amd64 runners.
- podman-promote (new): server-side retag via skopeo copy --all — releases
  promote the scanned sha-<commit> candidate instead of rebuilding.
- deploy-prod (new): shared deploy body for the *.podman repos (with the
  BatchMode/IdentitiesOnly ssh flags only two of the four copies had).
- README: documents the standard build.yml/release.yml pipeline; refs
  standardized on public/actions.

Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

trivy-scan/action.yaml

@@ -0,0 +1,54 @@
+name: Trivy Scan
+description: >
+  Scan an image in registry.noctrl.eu for vulnerabilities and fail on findings.
+  Pulls the image directly from the registry — no podman storage involved.
+  Pin the calling job to an amd64 runner (never arm); vulnerability results are
+  package-based and arch-independent, so scanning a multi-arch ref once
+  (trivy picks the host platform's variant) covers all variants.
+
+inputs:
+  image-name:
+    description: Repository/image name path, for example noctrl/gitea-runner
+    required: true
+  tag:
+    description: Tag to scan, for example sha-abc123 or sha-abc123-amd64
+    required: true
+  severity:
+    description: Comma-separated Trivy severities that fail the scan.
+    required: false
+    default: HIGH,CRITICAL
+  registry-username:
+    description: Registry username for pulling the image.
+    required: true
+  registry-password:
+    description: Registry password for pulling the image.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - id: scan
+      shell: bash
+      env:
+        TRIVY_USERNAME: ${{ inputs.registry-username }}
+        TRIVY_PASSWORD: ${{ inputs.registry-password }}
+      run: |
+        set -euo pipefail
+
+        if ! command -v trivy >/dev/null 2>&1; then
+          echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
+          exit 1
+        fi
+
+        image_ref="registry.noctrl.eu/${{ inputs.image-name }}:${{ inputs.tag }}"
+
+        # --ignore-unfixed: unfixed base-image CVEs are unactionable and would
+        # perma-block builds; the gate is on vulnerabilities with a fix.
+        echo "Scanning ${image_ref} (fail on: ${{ inputs.severity }}, fixed only)"
+        trivy image \
+          --scanners vuln \
+          --severity "${{ inputs.severity }}" \
+          --ignore-unfixed \
+          --exit-code 1 \
+          --no-progress \
+          "${image_ref}"