ci: publish editor image to GHCR

[luisalrp]

What does this PR do?

Publishes the official editor Docker image to GHCR as part of the release workflow and updates Docker Compose to consume the published image. Stable releases receive both version and latest tags; beta and recovery releases receive only their version tag. Images are published for amd64 and arm64. Fixes #770.

How to test

1. Run docker compose config and verify the service uses ghcr.io/pascalorg/editor:latest by default.
2. Set IMAGE_TAG to a release version and verify Compose uses the versioned image.
3. Run the release workflow in dry-run mode for stable, beta, and recovery releases and verify only stable releases generate the latest tag.
4. Verify the Docker build publishes linux/amd64 and linux/arm64 platforms.

Screenshots / screen recording

N/A — non-visual CI and deployment change.

Checklist

• I've tested this locally with bun dev
• My code follows the existing code style (run bun check to verify)
• I've updated relevant documentation (if applicable)
• This PR targets the main branch

---

Note

Medium Risk
Release workflow now publishes container artifacts and changes the default deployment path from local builds to GHCR pulls, which depends on registry permissions and public package visibility.

Overview
Editor releases now build and push a multi-arch (linux/amd64, linux/arm64) image to ghcr.io/pascalorg/editor as part of the release workflow when editor or all is selected. The job gets packages: write, logs into GHCR on non–dry-run releases, and tags images with the release version; latest is added only for patch/minor/major bumps (not beta or recovery-style runs). Dry runs still build but do not push or log in.

Docker Compose no longer builds locally—it pulls ghcr.io/pascalorg/editor:${IMAGE_TAG:-latest}. SETUP.md documents IMAGE_TAG and one-time steps to make the GHCR package public for unauthenticated pulls. The Dockerfile adds an org.opencontainers.image.source label for registry metadata.

^{Reviewed by Cursor Bugbot for commit ba93d72. Bugbot is set up for automated code reviews on this repo. Configure here.}

[pascal]

I hit an error while handling your request (Model unavailable on AI Gateway free tier: Free tier users do not have access to this model. Upgrade to paid credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up for unrestricted…).

Please try again, rephrase, or reach out if it keeps failing.

Error id: 8bdf2076-e7df-4ba7-a14d-19a6b7dcc978

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b10b01d. Configure here.}

[Aymericr]

Blocking the current rollout shape: this changes the checked-in default from a working local build to ghcr.io/pascalorg/editor:latest before that package/tag exists and before its visibility can be made public. Immediately after merge, a fresh docker compose up -d can therefore fail at the official documented entry point until a maintainer runs a release and completes the manual organization-package step.

Please keep the source-build path working during bootstrap (or land publication first without switching Compose, verify an amd64/arm64 public manifest, then switch Compose in a follow-up). The release integration also needs a maintainer-reviewed rollback/partial-release decision because an image failure occurs after the editor npm publish step. I’m marking this for human release ownership rather than merging an unverified registry transition.