ci: add tag-triggered container publish workflow

README.md

@@ -71,6 +71,32 @@ docker compose up -d --build
 
 Then open `http://<host>:8091`.
 
+## Container publishing pipeline
+
+A Gitea Actions workflow lives at `.gitea/workflows/release-container.yml`.
+Whenever a git tag is pushed, the self-hosted runner:
+
+1. checks out the tagged commit,
+2. builds the Docker image from `Dockerfile`,
+3. tags it as both the sanitized git tag and `latest`,
+4. pushes both tags to the Gitea container registry at
+   `192.168.33.22:3300/gemma/arcana-fx`.
+
+The workflow authenticates with the repository Actions secret `PACKAGES_TOKEN`.
+Example release flow:
+
+```bash
+git tag v0.1.0
+git push origin v0.1.0
+```
+
+After the workflow finishes, the image can be pulled with:
+
+```bash
+docker pull 192.168.33.22:3300/gemma/arcana-fx:v0.1.0
+docker pull 192.168.33.22:3300/gemma/arcana-fx:latest
+```
+
 ## Run locally (no Docker)
 
 Requires Node.js 20+.