ci: Add GitHub Container Registry (ghcr.io) publishing

[terafin]

Summary

This PR adds GitHub Container Registry (ghcr.io) as an additional publishing target alongside Docker Hub.

Refs #969

Motivation

Docker Hub's rate limiting (100 pulls/6hrs anonymous, 200 free) increasingly impacts CI/CD and self-hosted infrastructure. ghcr.io provides no rate limits for public images, a unified code+containers ecosystem, needs no extra secrets (uses the existing GITHUB_TOKEN), and reuses the same build — just an additional registry target.

Changes

• .github/workflows/release.yaml:
  • Added packages: write to the existing top-level permissions: block (kept contents: write).
  • Added a "Log in to GitHub Container Registry" step (docker/login-action@v3, registry: ghcr.io, username: ${{ github.actor }}, password: ${{ secrets.GITHUB_TOKEN }}) immediately after the existing Docker Hub login. The Docker Hub login has no if: guard (this workflow only triggers on v* tag pushes), so the ghcr login mirrors that with no guard.
• .goreleaser.yaml:
  • Added a ghcr.io/{{ .ProjectName }} image template to each per-arch dockers: entry (amd64, arm64, armv7), alongside the existing Docker Hub image templates, via new YAML anchors. Existing image templates, build flags, platforms, and Dockerfile are unchanged.
  • Added two docker_manifests: entries mirroring the existing ones — ghcr.io/{{ .ProjectName }}:{{ .Tag }} and ghcr.io/{{ .ProjectName }}:latest (skip_push: auto) — referencing the new per-arch ghcr anchors. The existing Docker Hub manifests are untouched.

The image name glanceapp/glance is already lowercase, so no case normalization was needed. The full multi-arch (amd64/arm64/armv7) tag strategy is mirrored exactly.

Backward Compatibility

Fully backward compatible — Docker Hub publishing is unchanged; this only adds an additional registry target.

Testing

• Workflow YAML validated
• Builds in maintainer CI on merge

🤖 Generated with Claude Code

🔧 One-time maintainer step: make the GHCR package public

Heads-up for maintainers: the first time this workflow publishes to ghcr.io/glanceapp/glance, GitHub creates the package as private by default. To let users docker pull it without authentication, a maintainer needs to set its visibility to Public once:

Repo Packages → the new glance package → Package settings → Danger Zone → Change visibility → Public

It's a one-time action — subsequent pushes inherit the setting. (Flagged by an automated reviewer; surfacing it here so the rollout is smooth.)