ci(deploy): publish images via Gitea Registry and verify on CD

CI workflows now own image publishing: backend-ci and frontend-ci push
service images to the Gitea Registry tagged with commit8. CD workflows
(nas-compose-deploy, nas-compose-service-deploy, offline-package, the
new nas-k3s-deploy) pull and verify those tags instead of rebuilding,
so deployments fail fast when CI hasn't produced the matching image.
The shared deploy/scripts/gitea-registry-images.sh helper drives both
the ensure (CI) and verify (CD) paths, and package.sh can now hydrate
its local images from the registry via SOURCE_IMAGE_REGISTRY.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/scripts/package.sh

@@ -20,6 +20,7 @@ DEPLOY_DIR="${REPO_ROOT}/deploy"
 IMAGE_TAG="${1:-latest}"
 PLATFORM="${2:-linux/amd64}"
 LOCAL_PREFIX="${LOCAL_PREFIX:-geo-rankly}"
+SOURCE_IMAGE_REGISTRY="${SOURCE_IMAGE_REGISTRY:-}"
 OUTPUT_DIR="${PACKAGE_OUTPUT_DIR:-${REPO_ROOT}}"
 DATE_TAG="$(date +%Y%m%d)"
 # 将 linux/amd64 → amd64，用于包名
@@ -52,47 +53,56 @@ fi
 # 确保 builder 已启动（首次使用时需要）
 docker buildx inspect --bootstrap "${BUILDER_NAME}" > /dev/null
 
-# ─── 构建自定义镜像 ────────────────────────────────────────────────────────────
-echo "==> [1/5] 构建自定义镜像 (platform: ${PLATFORM}, tag: ${IMAGE_TAG})"
+# ─── 准备自定义镜像 ────────────────────────────────────────────────────────────
+echo "==> [1/5] 准备自定义镜像 (platform: ${PLATFORM}, tag: ${IMAGE_TAG})"
 cd "${REPO_ROOT}"
 
-# 注意：--load 仅支持单平台；交叉编译时 buildx 使用 QEMU 或 Go 交叉编译
-_build() {
-  local target="$1" tag_suffix="$2"
-  shift 2
-  echo "    building ${LOCAL_PREFIX}/${tag_suffix}:${IMAGE_TAG}"
+if [[ -n "${SOURCE_IMAGE_REGISTRY}" ]]; then
+  echo "    pulling from ${SOURCE_IMAGE_REGISTRY}"
+  for svc in tenant-api worker-generate kol-assist-worker ops-api scheduler migrate frontend ops-web; do
+    echo "    pulling ${SOURCE_IMAGE_REGISTRY}/${svc}:${IMAGE_TAG}"
+    docker pull --platform "${PLATFORM}" "${SOURCE_IMAGE_REGISTRY}/${svc}:${IMAGE_TAG}"
+    docker tag "${SOURCE_IMAGE_REGISTRY}/${svc}:${IMAGE_TAG}" "${LOCAL_PREFIX}/${svc}:${IMAGE_TAG}"
+  done
+else
+  # 注意：--load 仅支持单平台；交叉编译时 buildx 使用 QEMU 或 Go 交叉编译
+  _build() {
+    local target="$1" tag_suffix="$2"
+    shift 2
+    echo "    building ${LOCAL_PREFIX}/${tag_suffix}:${IMAGE_TAG}"
+    docker buildx build \
+      --platform "${PLATFORM}" \
+      --target "${target}" \
+      "$@" \
+      --tag "${LOCAL_PREFIX}/${tag_suffix}:${IMAGE_TAG}" \
+      --load \
+      -f server/Dockerfile \
+      server/
+  }
+
+  _build runtime tenant-api      --build-arg SERVICE=tenant-api
+  _build runtime worker-generate --build-arg SERVICE=worker-generate
+  _build runtime kol-assist-worker --build-arg SERVICE=kol-assist-worker
+  _build runtime ops-api         --build-arg SERVICE=ops-api
+  _build runtime scheduler       --build-arg SERVICE=scheduler
+  _build migrate migrate         # migrate stage 不需要 SERVICE arg
+
+  echo "    building ${LOCAL_PREFIX}/frontend:${IMAGE_TAG}"
   docker buildx build \
     --platform "${PLATFORM}" \
-    --target "${target}" \
-    "$@" \
-    --tag "${LOCAL_PREFIX}/${tag_suffix}:${IMAGE_TAG}" \
+    --tag "${LOCAL_PREFIX}/frontend:${IMAGE_TAG}" \
     --load \
-    -f server/Dockerfile \
-    server/
-}
+    -f Dockerfile.frontend \
+    .
 
-_build runtime tenant-api      --build-arg SERVICE=tenant-api
-_build runtime worker-generate --build-arg SERVICE=worker-generate
-_build runtime kol-assist-worker --build-arg SERVICE=kol-assist-worker
-_build runtime ops-api         --build-arg SERVICE=ops-api
-_build runtime scheduler       --build-arg SERVICE=scheduler
-_build migrate migrate         # migrate stage 不需要 SERVICE arg
-
-echo "    building ${LOCAL_PREFIX}/frontend:${IMAGE_TAG}"
-docker buildx build \
-  --platform "${PLATFORM}" \
-  --tag "${LOCAL_PREFIX}/frontend:${IMAGE_TAG}" \
-  --load \
-  -f Dockerfile.frontend \
-  .
-
-echo "    building ${LOCAL_PREFIX}/ops-web:${IMAGE_TAG}"
-docker buildx build \
-  --platform "${PLATFORM}" \
-  --tag "${LOCAL_PREFIX}/ops-web:${IMAGE_TAG}" \
-  --load \
-  -f Dockerfile.ops-web \
-  .
+  echo "    building ${LOCAL_PREFIX}/ops-web:${IMAGE_TAG}"
+  docker buildx build \
+    --platform "${PLATFORM}" \
+    --tag "${LOCAL_PREFIX}/ops-web:${IMAGE_TAG}" \
+    --load \
+    -f Dockerfile.ops-web \
+    .
+fi
 
 # ─── 拉取基础设施镜像（指定平台） ─────────────────────────────────────────────
 echo "==> [2/5] 拉取基础设施镜像 (platform: ${PLATFORM})"