actions/checkout@v5 stored the job's GitHub token in .git/config, and
the image copies .git, so published images contained it. Use checkout
v7 with persist-credentials: false.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Builds the image and pushes it to ghcr.io/uio-gaming/mustafa, tagged with the release version and latest. It runs as a job in the release-please workflow, because releases created with GITHUB_TOKEN don't trigger other workflows.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>