Publish v0.1.0 image; fix publish namespace and docker sample workflows

- publish-image.sh: add REGISTRY_NAMESPACE for Gitea Container Registry path
- sample workflows: run docker login/build/push on host label (bundled docker
  CLI + mounted socket); fix doubled image path in build/push sample
- docs: record v0.1.0 publish and remaining secret-gated push validation

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

test/sample-workflows/docker-build-push.yml

@@ -1,13 +1,19 @@
 name: Smoke — Docker Build and Push
 
+# Runs on the `host` label so docker build/push use the runner container's
+# bundled Docker CLI and the mounted /var/run/docker.sock. The `ubuntu-latest`
+# label runs steps inside a node job container that has neither.
+#
+# Requires repo Action secrets:
+#   REGISTRY_USER  — registry username (e.g. your Gitea user)
+#   REGISTRY_TOKEN — a scoped package read/write token (NOT an admin API token)
+
 on:
-  push:
-    branches: [main]
   workflow_dispatch:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: host
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -21,11 +27,12 @@ jobs:
 
       - name: Build and Push
         run: |
+          # gitea.repository is already "owner/repo" (e.g. jason/forgerunner)
+          IMAGE="registry.alwisp.com/${{ gitea.repository }}"
           docker build \
-            -t registry.alwisp.com/${{ gitea.repository_owner }}/${{ gitea.repository }}:latest \
-            -t registry.alwisp.com/${{ gitea.repository_owner }}/${{ gitea.repository }}:${{ gitea.sha }} \
+            -t "${IMAGE}:latest" \
+            -t "${IMAGE}:${{ gitea.sha }}" \
             -f docker/runner/Dockerfile \
             .
-
-          docker push registry.alwisp.com/${{ gitea.repository_owner }}/${{ gitea.repository }}:latest
-          docker push registry.alwisp.com/${{ gitea.repository_owner }}/${{ gitea.repository }}:${{ gitea.sha }}
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${{ gitea.sha }}"

test/sample-workflows/docker-login.yml

@@ -5,7 +5,9 @@ on:
 
 jobs:
   login:
-    runs-on: ubuntu-latest
+    # Use `host` so the Docker CLI and mounted socket are available; the
+    # `ubuntu-latest` job container has neither.
+    runs-on: host
     steps:
       - name: Log in to Gitea Container Registry
         uses: docker/login-action@v3