ci: auto build & push image on main (:latest) + v* tags

Mirror mort-ci.yml's build-and-push: BuildKit secrets (REGISTRY_USER/
REGISTRY_PASSWORD) for private majordomo access instead of build-args, and the
LAN --add-host so the builder can reach the registry. push main -> :latest +
:sha-<short>; tag v* -> :<tag> + :latest; other branches -> :branch-<safe>;
PRs build-only (no push). Optional DISCORD_WEBHOOK_URL notifications.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -65,13 +65,15 @@ cmd/gadfly/            the agentic reviewer binary (majordomo + Ollama Cloud); z
 scripts/run.sh         fetches the PR diff, runs the reviewer, upserts one labeled comment
 scripts/system-prompt.txt  the reviewer persona + verification discipline
 entrypoint.sh          the container brains: trigger gating, clone, model loop (logic lives here, not in YAML)
-Dockerfile             multi-stage; the build-time module token never reaches the final image
-.gitea/workflows/build-image.yml   tags v* → build & push the image
+Dockerfile             multi-stage; build-time module creds (BuildKit secrets) never reach the final image
+.gitea/workflows/build-image.yml   push to main → :latest; tag v* → :<tag> + :latest
 examples/              the ~15-line stub a consuming repo drops in
 ```
 
-The image is published to `gitea.stevedudenhoeffer.com/steve/gadfly`. Push a `v*` tag to
-build and publish a new version (and `:latest`).
+The image is published to `gitea.stevedudenhoeffer.com/steve/gadfly`. Every push to `main`
+rebuilds and republishes `:latest` (plus `:sha-<short>`); pushing a `v*` tag publishes that
+pinned version (plus `:latest`). Pin consumers to a `:vN` tag for stability, or track
+`:latest` to ride main.
 
 ## Configuration (advanced)