docker: image for the Oracle server, Trivy gate, and a release workflow

Next standalone build in three stages, non-root, healthchecked. next 15.5.28
(image-optimiser RCE) with postcss pinned past the copy bundled by next.
release.yml publishes linux/arm64 to the Gitea registry. The book/ directory is
a repository of its own and stays out of the build context.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -0,0 +1,67 @@
+name: Release
+
+# Publica a imagem no registro de containers do Gitea depois de um merge em main,
+# e de novo com tag semver quando uma tag v* é enviada. O servidor só faz pull.
+# Precisa do secret de usuário REGISTRY_TOKEN (token do Gitea com write:package).
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+env:
+  REGISTRY: git.lucasrguerra.dev.br
+
+jobs:
+  # Nada é publicado sem a suíte completa passar antes.
+  ci:
+    uses: ./.gitea/workflows/ci.yml
+
+  publicar:
+    name: Publica a imagem (linux/arm64)
+    needs: ci
+    # O único runner é arm64 e o servidor de destino (Oracle) também, então a
+    # imagem é construída nativamente, sem emulação.
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v4
+
+      - id: nome
+        run: |
+          repo='${{ gitea.repository }}'
+          echo "image=${{ env.REGISTRY }}/${repo,,}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-buildx-action@v4
+
+      - name: Autentica no registro
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN }}
+
+      - name: Metadados
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ steps.nome.outputs.image }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest
+            type=sha,format=long
+
+      - name: Build e push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=${{ steps.nome.outputs.image }}:buildcache
+          cache-to: type=registry,ref=${{ steps.nome.outputs.image }}:buildcache,mode=max