Add a release workflow that pushes the container image on a new tag

Also lets CI fetch Reef from this server, as the other sharks repositories do.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    env:
+      GOPRIVATE: git.veillax.com
     steps:
       - uses: actions/checkout@v4
 
@@ -15,6 +17,11 @@ jobs:
         with:
           go-version-file: go.mod
 
+      # Go fetches Reef straight from this server. Harmless for public repositories and
+      # what makes private ones work.
+      - name: Let Go fetch modules from this server
+        run: git config --global url."https://x-access-token:${{ secrets.GITHUB_TOKEN }}@git.veillax.com/".insteadOf "https://git.veillax.com/"
+
       - name: Formatting
         run: |
           unformatted=$(gofmt -l cmd internal)