Adds a second registry login + tag to both build-push workflows so each
build publishes to ghcr.io alongside the in-house Gitea registry. Single
build, two destinations — docker/build-push-action handles the multi-tag
push in one step.
Requires Gitea Actions secret GHCR_TOKEN (a classic PAT with
write:packages on the shadowdao user).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
