Mirrors the reimpasto blueprint pipeline: tag release/x.y.z builds the
image (backend + WASM frontend in one multi-stage build) and pushes
gitea.woggioni.net/woggioni-opencode-agent/scopa:x.y.z plus :latest.
The build context is the repository root and the Dockerfile is
server/Dockerfile (monorepo layout). Requires the repo secret
PUBLISHER_TOKEN with write:package scope.
