actions/upload-artifact@v4 doesn't work on Gitea (GHES error).
No need for multi-job — all steps share the same Docker socket
so local/name:build images are visible throughout. Single
build-scan-report job: build → push → scan → report.
Zero GitHub Actions used in the Gitea backend now:
- crane for daemonless push
- trivy binary for local image scan
- uv via install script
- plain docker build via socket
d76e264953
