Build and release now run in one workflow on push to main: after the build passes, if no tag exists for the package.json version, the image is pushed and the tag and Gitea release are created. Running them in sequence avoids the action-cache race between the separate build and tag-triggered release workflows.