feat(cicd): Gitea Actions pipeline, deterministic image tagging

Automatic test/build/tag/staging-deploy on push to main; production
promotion stays a manual, human-run step (deploy-production.sh) - never
automated. SHA-tagged images always, semantic tags only on deliberate
release, never :latest alone in staging/production. No paid CI provider or
registry required (uses Gitea's own). Real regression job installs all
services, applies real migrations against a service Postgres, runs the
infra validation scripts.

Validated as real YAML (python3 yaml parse).

infra/scripts/ci/tag-and-push.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Builds and pushes all five RootNode images, tagged by git SHA (always) and, on an explicit
+# release, a semantic tag too. See infra/docker/IMAGE_STRATEGY.md for the full policy — this
+# script is just the mechanical implementation of it.
+#
+# Required env: REGISTRY, REGISTRY_USER, REGISTRY_PASSWORD
+# Optional env: RELEASE_TAG (e.g. v1.2.0 — if set, also tags+pushes this on top of the sha tag)
+set -euo pipefail
+cd "$(dirname "$0")/../../.."   # repo root
+
+: "${REGISTRY:?REGISTRY is required}"
+: "${REGISTRY_USER:?REGISTRY_USER is required}"
+: "${REGISTRY_PASSWORD:?REGISTRY_PASSWORD is required}"
+
+SHA="$(git rev-parse HEAD)"
+SHA_TAG="sha-${SHA:0:12}"
+
+echo "$REGISTRY_PASSWORD" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+
+declare -A IMAGES=(
+  [rootnode/platform-api]="platform/api/Dockerfile ."
+  [rootnode/gateway]="platform/gateway/Dockerfile platform/gateway"
+  [rootnode/provisioner]="platform/provisioner/Dockerfile platform/provisioner"
+  [rootnode/egress-proxy]="platform/egress-proxy/Dockerfile platform/egress-proxy"
+  [rootnode/lab]="Dockerfile ."
+)
+
+for image in "${!IMAGES[@]}"; do
+  read -r dockerfile context <<< "${IMAGES[$image]}"
+  full="$REGISTRY/$image"
+  echo "==> Building $full:$SHA_TAG (context: $context, dockerfile: $dockerfile)"
+  docker build -f "$dockerfile" -t "$full:$SHA_TAG" "$context"
+  docker push "$full:$SHA_TAG"
+
+  if [ -n "${RELEASE_TAG:-}" ]; then
+    docker tag "$full:$SHA_TAG" "$full:$RELEASE_TAG"
+    docker push "$full:$RELEASE_TAG"
+  fi
+done
+
+echo "==> Done. Built tag: $SHA_TAG${RELEASE_TAG:+, $RELEASE_TAG}"
+echo "$SHA_TAG" > /tmp/rootnode-last-built-tag   # convenience for a following CI step