Mirrors the existing .gitea/workflows/docker-publish.yml but targets ghcr.io on the GitHub mirror. Simpler than the Gitea version since the built-in GITHUB_TOKEN has native package-write rights on GHCR, no PAT secret needed.