feat: address the review on the image publicity gate by passing build-push only the seven services that workflow actually publishes, since web, admin and cli have no :dev tag and would have warned falsely on every push to main, by taking the release tag through the step env instead of interpolating github.ref_name into the shell, and by no longer asserting the tag is fine when a pull is refused, because GHCR denies an unknown namespace exactly as it denies a private one, so a mistyped --registry now gets its own reading in the installer message, the troubleshooting table and the fork note, which also splits the personal and organization paths to the visibility setting

.github/workflows/build-push.yml

@@ -274,5 +274,10 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v4
+      # Only what this workflow publishes. web, admin and cli are built at
+      # tag time and have no :dev tag, so checking them here would warn about
+      # something no push to main can fix.
       - name: Pull-test every image anonymously
-        run: ./scripts/check-images-public.sh --prefix "$IMAGE_PREFIX" --tag dev --warn
+        run: |
+          ./scripts/check-images-public.sh --prefix "$IMAGE_PREFIX" --tag dev --warn \
+            backend consumer worker forms updater tracking realtime

.github/workflows/release.yml

@@ -287,7 +287,9 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Pull-test every image anonymously
-        run: ./scripts/check-images-public.sh --prefix "$IMAGE_PREFIX" --tag "${{ github.ref_name }}"
+        env:
+          TAG: ${{ github.ref_name }}
+        run: ./scripts/check-images-public.sh --prefix "$IMAGE_PREFIX" --tag "$TAG"
 
   create-release:
     name: Create GitHub Release