feat(dist): add GHCR push and Homebrew tap to release pipeline

Docker releases now dual-push to Docker Hub and ghcr.io/lerkolabs/uptop.
GoReleaser brews section generates a Homebrew formula and pushes to
lerkolabs/homebrew-tap on GitHub.

Requires new Gitea secrets:
- GHCR_USERNAME / GHCR_TOKEN for GHCR login
- HOMEBREW_TAP_GITHUB_TOKEN for tap repo push
- GitHub repo lerkolabs/homebrew-tap must exist

.gitea/workflows/release-binaries.yml

@@ -53,6 +53,7 @@ jobs:
           GORELEASER_FORCE_TOKEN: gitea
           GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           GITEA_API_URL: http://gitea:3000/api/v1
+          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
 
       # GitHub release relaying is handled by .github/workflows/mirror-release.yml,
       # which runs on GitHub Actions when the push mirror delivers the tag and

.gitea/workflows/release-docker.yml

@@ -35,11 +35,16 @@ jobs:
 
           TAGS="lerkolabs/uptop:${TAG}"
           TAGS="${TAGS},lerkolabs/uptop:sha-${SHORT_SHA}"
+          TAGS="${TAGS},ghcr.io/lerkolabs/uptop:${TAG}"
+          TAGS="${TAGS},ghcr.io/lerkolabs/uptop:sha-${SHORT_SHA}"
           # :latest only for real releases — rc rehearsal tags must not move it
           if [ "${{ github.ref_type }}" = "tag" ]; then
             case "$TAG" in
               *-*) ;;
-              *) TAGS="${TAGS},lerkolabs/uptop:latest" ;;
+              *)
+                TAGS="${TAGS},lerkolabs/uptop:latest"
+                TAGS="${TAGS},ghcr.io/lerkolabs/uptop:latest"
+                ;;
             esac
           fi
           echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
@@ -56,6 +61,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ secrets.GHCR_USERNAME }}
+          password: ${{ secrets.GHCR_TOKEN }}
+
       # Scan must gate the push: build amd64 locally, scan it, and only then run
       # the multi-arch push (amd64 layers come from the builder cache, so the
       # second build only adds the arm64 work).