Take the Gitea registry out of CI and mirror it separately

The Gitea registry is on a VPN, which a GitHub runner can never reach, so
the mirror step in the release workflow could only ever fail: its last four
releases reported a step that did nothing. The workflow now builds and
pushes to GHCR alone, which is the registry the installer defaults to, and
nothing in CI mentions Gitea.

The image reaches the Gitea registry through `scripts/mirror-gitea.sh`
(`bun run mirror:gitea`) instead, run in parallel with a release and from the
VPN side: it copies from the Gitea host over ssh, where skopeo can see both
registries, so nothing has to be installed there. `skopeo copy --all` keeps
the manifest list and its signatures, and every destination tag is read back
and compared with GHCR's digest, so a partial copy fails loudly instead of
being assumed to have worked. `latest` and `major.minor` are only moved while
that release still owns them in GHCR, so mirroring an older release never
rolls them back.

Neither direction can fail the other now, which is the point: a registry that
is down, slow or full no longer takes a release with it.

scripts/publish-gitea.sh

@@ -8,9 +8,10 @@
 # creates the Gitea release over the API.
 #
 # Gitea has no release workflow, so nothing is built here: the image is built
-# once by .github/workflows/release.yml and mirrored to
-# git.tben.me/moduletrace/cobble. This script only publishes the source and
-# the release object.
+# once by .github/workflows/release.yml and copied into the Gitea registry by
+# scripts/mirror-gitea.sh, run from the VPN side, since a GitHub runner can
+# never reach it. This script only publishes the source and the release
+# object.
 #
 # The token comes from GITEA_TOKEN, or from the Gitea section of ~/.config/tea
 # if the tea CLI is installed. It needs the `write:repository` scope on the
@@ -221,6 +222,5 @@ else
 fi
 
 print_release_summary "$REMOTE" "$BRANCH" "https://${REMOTE_HOST}/${REPO_SLUG}/releases/tag/$TAG"
-printf '\nThe image is built by the GitHub release; mirror it into the Gitea registry with:\n'
-printf '    docker buildx imagetools create --tag git.tben.me/moduletrace/cobble:latest \\\n'
-printf '        ghcr.io/moduletrace/cobble:latest\n'
+printf '\nThe image is built by the GitHub release, which cannot reach this registry.\nOnce that build has finished, copy it in over the VPN with:\n'
+printf '    bun run mirror:gitea\n'