Publish v0.1.0 image; fix publish namespace and docker sample workflows

- publish-image.sh: add REGISTRY_NAMESPACE for Gitea Container Registry path
- sample workflows: run docker login/build/push on host label (bundled docker
  CLI + mounted socket); fix doubled image path in build/push sample
- docs: record v0.1.0 publish and remaining secret-gated push validation

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

forgerunner.src/ROADMAP.md

@@ -161,7 +161,8 @@ The project is considered successful when it can:
 ### Notes
 
 - `.gitea/workflows/ci-smoke.yml` (run 110, `success`) validated on the live runner via the `host` label: `actions/checkout@v4`, bundled node/npm/git/docker versions, and Docker-socket access (`docker info`) all pass.
-- `docker/login-action` + `docker build` + `docker push` and publishing the image to `registry.alwisp.com` are blocked on registry credentials (no local docker auth, no repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN`).
+- Image published: `registry.alwisp.com/jason/custom-gitea-runner:v0.1.0` + `:latest` (login via the jason Gitea account succeeded; push validated the registry round-trip).
+- `docker/login-action` + `docker build` + `docker push` **from a workflow** still pending: needs repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN`. Recommend a dedicated scoped package token rather than the admin API token. Corrected sample workflows (`test/sample-workflows/docker-login.yml`, `docker-build-push.yml`) are ready to run on the `host` label once the secrets exist.
 
 ### Exit criteria