ci(github): publish the Docker image to GHCR on release

[7sharp9]

• Add publish-docker-image to tag-release.yml, gated on tag-and-release succeeding, so a Docker image is only published for a commit that was actually tagged and released.
• Builds Dockerfile at the same merge commit, linux/amd64 only, APP_VERSION build-arg matching the local DockerBuild target, GHA layer caching.
• Smoke tests the image (demo GENPRES_URL_ID, random throwaway password, / must return 200 within 60s) before pushing — verified locally against a real build, not just in CI.
• Pushes ghcr.io/informedica/genpres:<version>, plus :latest only on a stable (non-pre-release) version. GHCR is interim pending the informedica Docker Hub account (see issue thread); the registry is a single IMAGE_NAME env var so switching later is a small change.
• Amends ADR-0021 with the decisions table, updates DEVELOPMENT.md's Release Automation section, adds a design-history change log entry.

Follow-up needed after merge (not automatable)

• Package visibility: the first push creates the GHCR package as private under informedica. Someone with org admin rights needs to set informedica/genpres public in GitHub package settings, or the image is unpullable without a token.
• Build.fs's local DockerBuild default (halcwb/genpres) is unchanged in this PR — separate decision.

Test plan

• Built Dockerfile locally with the same APP_VERSION build-arg the workflow uses; build succeeded.
• Ran the built image with the demo GENPRES_URL_ID and a random password; / returned 200 on first poll, confirming the smoke-test step's assumptions (port 8085, startup timing).
• First real run of publish-docker-image on the next release PR merge (cannot be dry-run outside GitHub Actions).

Closes #234 item 3, addresses #459.

[greptile-apps]

Greptile Summary

The PR adds a release-gated job that builds, smoke-tests, and publishes an amd64 GenPRES image to GHCR, with latest reserved for stable releases. It also documents the registry choice, package-visibility follow-up, and release process.

• Exposes release metadata as outputs from tag-and-release.
• Builds and smoke-tests the exact merge commit before pushing its versioned tags.
• Updates release documentation and ADR history.
• The Docker-tag construction does not account for supported SemVer build metadata.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking compatibility gap for future releases that use SemVer build metadata.

The current version format follows the successful path, but a supported +build suffix would be copied into an invalid Docker tag after the GitHub Release had already been created.

Files Needing Attention: .github/workflows/tag-release.yml

Important Files Changed

Filename	Overview
.github/workflows/tag-release.yml	Adds the release-image build, smoke-test, and GHCR publication flow; version tags need Docker-compatible handling for SemVer build metadata.
DEVELOPMENT.md	Documents the new publication flow, interim registry, smoke test, and required package-visibility operation.
docs/mdr/design-history/0021-build-system-versioning-and-release.md	Records the Docker publication architecture, tag policy, tooling choices, and accepted operational trade-offs.
docs/mdr/design-history/0000-change-log.md	Adds the corresponding reverse-chronological ADR amendment entry.

Sequence Diagram

sequenceDiagram
  participant R as Release PR merge
  participant T as tag-and-release
  participant D as publish-docker-image
  participant G as GHCR
  R->>T: Closed and merged release/master PR
  T->>T: Validate version and release notes
  T->>T: Create Git tag and GitHub Release
  T-->>D: version, tag, prerelease
  D->>D: Check out merge commit
  D->>D: Build amd64 image
  D->>D: Run container and smoke-test /
  alt Smoke test succeeds
    D->>G: Push version tag
    opt Stable release
      D->>G: Push latest tag
    end
  else Smoke test fails
    D-->>D: Stop before push
  end

Loading

_{Reviews (1): Last reviewed commit: "ci(github): publish the Docker image to ..." | Re-trigger Greptile}