ci: push per-SHA image tag (PORT rollback support) [skip ci]

.gitea/workflows/docker-build.yml

@@ -42,6 +42,14 @@ jobs:
 
       # Dangling-only prune: removes untagged leftovers from previous builds. Never
       # removes the tagged :latest or any image referenced by a running container.
+      - name: Push per-SHA tag
+        if: success()
+        run: |
+          IMAGE="registry.alwisp.com/${{ gitea.repository }}"
+          GIT_SHA="$(git rev-parse --short=7 HEAD)"
+          docker tag "${IMAGE}:latest" "${IMAGE}:sha-${GIT_SHA}"
+          docker push "${IMAGE}:sha-${GIT_SHA}"
+
       - name: Prune dangling images on host
         if: always()
         run: docker image prune -f 2>/dev/null || true