Complete renamed image source and verify bounded consumer migration readiness

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

.forgejo/workflows/image.yaml

@@ -22,7 +22,14 @@ on:
       - "examples/**"
       - "go.mod"
       - "go.sum"
+      - "tools/publish-runtime-images.sh"
   workflow_dispatch:
+    inputs:
+      publish_runtime_rename:
+        description: "Publish both packages after the exact new public-package scope is accepted"
+        type: boolean
+        required: false
+        default: false
 
 env:
   REGISTRY: forgejo.coulomb.social
@@ -39,7 +46,8 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -eu
-          REF="${GITHUB_SHA:-main}"
+          REF="${GITHUB_SHA:?full source revision required}"
+          [[ "$REF" =~ ^[a-f0-9]{40}$ ]] || exit 2
           SHORT="${REF:0:7}"
           mkdir -p buildctx "${HOME}/bin"
           wget -qO /tmp/repo.tar.gz \
@@ -49,11 +57,13 @@ jobs:
             | tar xz --strip-components=1 -C "${HOME}/bin" docker/docker
           export PATH="${HOME}/bin:${PATH}"
           echo "${REGISTRY_TOKEN}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
-          IMAGE="${REGISTRY}/${IMAGE_NAME}"
-          docker build -f buildctx/Containerfile -t "${IMAGE}:latest" -t "${IMAGE}:main-${SHORT}" buildctx
-          docker push "${IMAGE}:latest"
-          docker push "${IMAGE}:main-${SHORT}"
-          echo "pushed ${IMAGE}:latest and ${IMAGE}:main-${SHORT}"
+          # Pushes keep the already admitted legacy package. Paired publication
+          # is an explicit owner dispatch after the daily red-batch disposition.
+          MODE=legacy
+          if [ "${{ github.event_name }}" = workflow_dispatch ] && [ "${{ inputs.publish_runtime_rename }}" = true ]; then
+            MODE=paired
+          fi
+          bash buildctx/tools/publish-runtime-images.sh "$REF" "$MODE" buildctx
 
       - name: Report immutable digest
         run: |
@@ -61,5 +71,6 @@ jobs:
           export PATH="${HOME}/bin:${PATH}"
           IMAGE="${REGISTRY}/${IMAGE_NAME}"
           SHORT="${GITHUB_SHA:0:7}"
-          # Deployments pin by digest, never by tag -- print it for the rollout step.
+          # Legacy package is available on ordinary push; paired digest verification
+          # runs in the publisher before an owner can switch any pin.
           docker inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:main-${SHORT}"