ci: the image job never ran — fix its condition, tag :latest, deploy for real

Three defects left the deployment frozen on an Aug-06 image while five
RBAC merges landed on main:

1. The job-level `hashFiles('Dockerfile')` condition evaluates BEFORE
   checkout, against an empty workspace — always '', so the job was
   silently skipped on every push to main.
2. Had it run, it pushed only sha-* and env-stage tags; orca deploys
   :latest, which nothing ever updated.
3. The final step ran `orca apply --env=stage` against a stage
   environment this cluster does not have.

Now: condition without hashFiles (the Dockerfile is not optional),
:latest tagged alongside sha-*, and the deploy step replaced with the
HMAC-signed orca webhook the other repos use (registered on the master;
ORCA_WEBHOOK_SECRET set as a repo Actions secret).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -99,33 +99,25 @@ jobs:
     # this job silently never ran (deployment sat on an Aug-06 image).
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: docker
-    # The runner's default job container has no docker CLI, so
-    # docker/login-action + docker/build-push-action die with "Unable to
-    # locate executable file: docker". Same pattern as the proven
-    # breakpilot-compliance build-push-deploy.yml: run in docker:27-cli
-    # (talks to the runner's daemon) and use plain docker commands.
-    container: docker:27-cli
     steps:
-      - name: Checkout
+      - uses: actions/checkout@v4
-        run: |
-          apk add --no-cache git curl openssl
-          git clone --depth 1 --branch ${GITHUB_REF_NAME} $(echo ${GITHUB_SERVER_URL} | sed -E "s#^(https?://)#\1ci:${{ secrets.GITHUB_TOKEN }}@#")/${GITHUB_REPOSITORY}.git .
 
-      - name: Login
+      - uses: docker/login-action@v3
-        env:
+        with:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          registry: repo.breakpilot.com
-          REGISTRY_PASS: ${{ secrets.REGISTRY_PASS }}
+          username: ${{ secrets.REGISTRY_USER }}
-        run: echo "$REGISTRY_PASS" | docker login repo.breakpilot.com -u "$REGISTRY_USER" --password-stdin
+          password: ${{ secrets.REGISTRY_PASS }}
 
-      - name: Build + push
+      - uses: docker/build-push-action@v6
-        run: |
+        with:
-          set -eu
+          push: true
-          docker build \
+          tags: |
-            -t repo.breakpilot.com/breakpilot/tenant-registry:latest \
+            repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:sha-${{ github.sha }}
-            -t repo.breakpilot.com/breakpilot/tenant-registry:sha-${GITHUB_SHA} \
+            repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:latest
-            .
+
-          docker push repo.breakpilot.com/breakpilot/tenant-registry:latest
+      - uses: anchore/sbom-action@v0
-          docker push repo.breakpilot.com/breakpilot/tenant-registry:sha-${GITHUB_SHA}
+        with:
+          image: repo.breakpilot.com/breakpilot/${{ github.event.repository.name }}:sha-${{ github.sha }}
 
       # Notify orca to pull :latest and recreate the service (same pattern as
       # breakpilot-core/build-pitch-deck.yml). The stage-env deploy this used to
@@ -135,7 +127,7 @@ jobs:
           ORCA_WEBHOOK_SECRET: ${{ secrets.ORCA_WEBHOOK_SECRET }}
           ORCA_WEBHOOK_URL: http://46.225.100.82:6880/api/v1/webhooks/github
         run: |
-          set -eu
+          set -euo pipefail
           PAYLOAD="{\"ref\":\"refs/heads/main\",\"repository\":{\"full_name\":\"${GITHUB_REPOSITORY}\"},\"head_commit\":{\"id\":\"${GITHUB_SHA}\",\"message\":\"ci: tenant-registry image build\"}}"
           SIG=$(printf '%s' "$PAYLOAD" | openssl dgst -sha256 -hmac "$ORCA_WEBHOOK_SECRET" -r | awk '{print $1}')
           curl -sSf -k \