CI workflows now own image publishing: backend-ci and frontend-ci push
service images to the Gitea Registry tagged with commit8. CD workflows
(nas-compose-deploy, nas-compose-service-deploy, offline-package, the
new nas-k3s-deploy) pull and verify those tags instead of rebuilding,
so deployments fail fast when CI hasn't produced the matching image.
The shared deploy/scripts/gitea-registry-images.sh helper drives both
the ensure (CI) and verify (CD) paths, and package.sh can now hydrate
its local images from the registry via SOURCE_IMAGE_REGISTRY.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lower keep_releases default to 1 to reduce NAS disk usage, and clear
the bundled siliconflow retrieval api_key so deployments must supply
their own credentials.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
root