Mirrors the reimpasto blueprint pipeline: tag release/x.y.z builds the image (backend + WASM frontend in one multi-stage build) and pushes gitea.woggioni.net/woggioni-opencode-agent/scopa:x.y.z plus :latest. The build context is the repository root and the Dockerfile is server/Dockerfile (monorepo layout). Requires the repo secret PUBLISHER_TOKEN with write:package scope.