ci: port the rust, chart, docker, web and edge-publish gates from the rhema repository

The android workflow came over with the tree; the rest of the old
repo's CI was framework-shaped. What the claw needs is the rust
gate (fmt, clippy, release build with the binary artifact, offline
tests), the chart lint/render suite, the daemon image smoke test,
the web bundle, and the edge + release publishing pair (latest/sha
images on main, exact-version images and chart on a v* tag).

Dropped on the way: the crates.io publish-order and claw-boundary
checks (nothing here publishes to crates.io; the boundary is
enforced by the tree layout now), the cloudflare wasm gate, the
binary release legs, and the manifest/crates.io release jobs — all
framework concerns that stayed in the rhema repository.

Release tags are checked against the workspace version by a
verify-tag job that the image legs wait on.

.gitea/workflows/release.yaml

@@ -0,0 +1,110 @@
+# The release channel: a v* tag ships the exact-version images (plus
+# the sha pin the chart's appVersion resolves to) and the exact-version
+# chart. Edge publishing on every main push lives in ci.yml. Release
+# candidates (a v* tag with a prerelease suffix, v0.2.0-rc1) publish
+# nothing. The daemon crate itself is `publish = false`, so no
+# crates.io leg runs here: the crates the claw pulls live in the rhema
+# repository's release channel.
+name: release
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: git.vhaudiquet.fr
+  OWNER: vhaudiquet
+
+jobs:
+  verify-tag:
+    # cargo build ships whatever the manifest declares, regardless of
+    # the tag: a mismatch must fail loudly instead of shipping the
+    # wrong version under the release tag.
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check the tag matches the workspace version
+        run: |
+          crate_version="$(grep -m1 '^version =' Cargo.toml | awk -F'"' '{print $2}')"
+          tag_version="${GITHUB_REF_NAME#v}"
+          if [ "$crate_version" != "$tag_version" ]; then
+            echo "tag $GITHUB_REF_NAME does not match workspace version $crate_version" >&2
+            exit 1
+          fi
+
+  build-and-push-release-images:
+    # The same two deployable images as the edge channel, tagged for the
+    # release: the exact version, the rolling stable pin, and the sha
+    # the chart's appVersion resolves to.
+    if: ${{ !contains(gitea.ref_name, '-') }}
+    needs: verify-tag
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - dockerfile: deploy/docker/claw.Dockerfile
+            image: rhema-claw
+          - dockerfile: deploy/docker/ui.Dockerfile
+            image: rhema-claw-ui
+    steps:
+      - name: Checkout repository
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Log in to container registry
+        uses: docker/login-action@v3
+        with:
+          registry: https://git.vhaudiquet.fr
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.PACKAGES_TOKEN }}
+
+      - name: Compute the release version (the tag strips the v)
+        id: ver
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: true
+          tags: |
+            git.vhaudiquet.fr/${{ env.OWNER }}/${{ matrix.image }}:${{ steps.ver.outputs.version }}
+            git.vhaudiquet.fr/${{ env.OWNER }}/${{ matrix.image }}:stable
+            git.vhaudiquet.fr/${{ env.OWNER }}/${{ matrix.image }}:${{ gitea.sha }}
+
+  release-chart:
+    # The exact tag version ships as-is so deployments can pin
+    # `--version 0.1.0`; appVersion pins the exact commit the image was
+    # built from (the chart's default image tag is appVersion, so the
+    # sha image above must exist before this runs).
+    if: ${{ !contains(gitea.ref_name, '-') }}
+    needs: build-and-push-release-images
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Install Helm
+        uses: azure/setup-helm@v5
+
+      - name: Update Chart version and appVersion
+        run: |
+          sed -i "s/^version:.*/version: \"${GITHUB_REF_NAME#v}\"/" deploy/helm/rhema-claw/Chart.yaml
+          sed -i "s/^appVersion:.*/appVersion: \"${{ gitea.sha }}\"/" deploy/helm/rhema-claw/Chart.yaml
+
+      - name: Lint Helm chart
+        run: helm lint deploy/helm/rhema-claw
+
+      - name: Package Helm chart
+        run: helm package deploy/helm/rhema-claw
+
+      - name: Push Helm chart to Gitea registry
+        run: |
+          TOKEN=$(echo -n "${{ secrets.PACKAGES_TOKEN }}" | tr -d '\n')
+          curl --fail --user "${{ gitea.actor }}:${TOKEN}" \
+            -X POST \
+            --upload-file rhema-claw-*.tgz \
+            "https://git.vhaudiquet.fr/api/packages/${{ env.OWNER }}/helm/api/charts"