Adapted from adguard-cidre's pipeline: build, syntax smoke-test, bats
unit tests, shellcheck lint, Trivy critical/high scans, then on push to
main a versioned publish (VERSION auto-bump, :latest/:X.Y/:X.Y.Z tags
retagged from the already-scanned image, and a categorized Gitea
Release). Requires the REGISTRY_TOKEN and CI_PUSH_TOKEN repo secrets
and branch protection on main (not yet configured on the Gitea side).
Co-Authored-By: Claude Sonnet 5 <[email protected]>
