fix(P1): Gitea Actions workflow + kaniko container publishing (REQ-180,181)

New .gitea/workflows/release.yml:
  - Triggers on push: tags: ['v*'] (deterministic)
  - Job 'ci': checkout + install Go + install coreci binary +
    coreci run (executes .coreci.yml: validate, build, test, release)
  - Job 'container-orca': kaniko executor:debug with --entrypoint
    /bin/sh, builds+pushes orca image (no DinD)
  - Job 'container-traefik': same, builds+pushes orca-traefik image
    (skips if Dockerfile.traefik absent at that tag)
  - Uses PAT_TOKEN secret (Gitea reserves GITEA_ prefix)

.coreci.yml:
  - Removed container-publish + container-publish-traefik steps
    (moved to Gitea Actions — CoreCI's podman executor appends sh -c
    which conflicts with kaniko's /kaniko/executor entrypoint)
  - Keeps validate/build/test/release (tarball + Gitea release)

scripts/trigger_coreci.sh:
  - Added tag ref handling (refs/tags/*) so pre-push hook triggers
    CoreCI for tag pushes too (Gitea Actions webhook is secondary)

---ci---
project: orca
phase: 1
milestone: v0.15
status: execute
---/ci---

scripts/trigger_coreci.sh

@@ -30,6 +30,20 @@ fi
 while read local_ref local_sha remote_ref remote_sha; do
   branch="${remote_ref#refs/heads/}"
   if [ -z "$branch" ] || [ "$branch" = "HEAD" ]; then
+    # Check if this is a tag push (refs/tags/*)
+    tag="${remote_ref#refs/tags/}"
+    if [ -n "$tag" ] && [ "$tag" != "$remote_ref" ]; then
+      echo "→ Triggering CoreCI for tag: $tag (${local_sha:0:7})"
+      payload=$(printf '{"repo":"coreci/orca","branch":"%s","ref":"%s"}' "$tag" "$local_sha")
+      if command -v curl >/dev/null 2>&1; then
+        curl -fsS -X POST "${CORECI_URL}/api/pipeline/run" \
+          -H "Authorization: token ${GITEA_TOKEN}" \
+          -H "Content-Type: application/json" \
+          -d "$payload" >/dev/null 2>&1 \
+          && echo "  ✓ CoreCI triggered" \
+          || echo "  (CoreCI trigger failed; Gitea Actions webhook is secondary path)"
+      fi
+    fi
     continue
   fi
   echo "→ Triggering CoreCI for branch: $branch (${local_sha:0:7})"