ci: remove legacy build/deploy from CI, use docker-release.yml

The build-and-push and deploy jobs were duplicated in ci.yml with missing
REGISTRY env vars, causing Docker login failures. docker-release.yml is
the canonical deploy pipeline (triggers on CI workflow_run completion).

.github/workflows/ci.yml

@@ -142,148 +142,5 @@ jobs:
       - name: Run E2E tests
         run: bash test-e2e.sh
 
-  build-operator:
-    runs-on: ubuntu-latest
-    if: false  # operator build removed — operator lives in bootnode/universe repo
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - run: echo "Operator build skipped"
-
-  build-and-push:
-    runs-on: ubuntu-latest
-    needs: [e2e-test]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    permissions:
-      contents: read
-      packages: write
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Log in to Container Registry (hanzoai)
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Log in to Container Registry (bootnode org)
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.BOOTNODE_GHCR_PAT }}
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Get short SHA
-        id: sha
-        run: echo "short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
-
-      - name: Build and push API image
-        uses: docker/build-push-action@v5
-        with:
-          context: ./api
-          push: true
-          platforms: linux/amd64
-          provenance: false
-          sbom: false
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:api-latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:api-${{ steps.sha.outputs.short }}
-            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:api-latest
-            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:api-${{ steps.sha.outputs.short }}
-          cache-from: type=gha,scope=api
-          cache-to: type=gha,mode=max,scope=api
-
-      - name: Build and push Web image (universal, brand selected at runtime)
-        uses: docker/build-push-action@v5
-        with:
-          context: ./web
-          push: true
-          platforms: linux/amd64
-          provenance: false
-          sbom: false
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:web-latest
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:web-${{ steps.sha.outputs.short }}
-            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:web-latest
-            ${{ env.REGISTRY }}/${{ env.CANONICAL_IMAGE }}:web-${{ steps.sha.outputs.short }}
-          cache-from: type=gha,scope=web
-          cache-to: type=gha,mode=max,scope=web
-
-  deploy:
-    runs-on: ubuntu-latest
-    needs: [build-and-push, build-operator]
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-    environment: production
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Fetch deploy credentials from KMS
-        id: kms
-        env:
-          KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
-          KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
-          HANZO_API_KEY: ${{ secrets.HANZO_API_KEY }}
-          KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
-        run: |
-          # Auth: Universal Auth (preferred) or legacy API key
-          if [ -n "${KMS_CLIENT_ID}" ] && [ -n "${KMS_CLIENT_SECRET}" ]; then
-            HANZO_API_KEY=$(curl -sf "${KMS_ENDPOINT}/api/v1/auth/universal-auth/login" \
-              -H "Content-Type: application/json" \
-              -d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" | jq -r '.accessToken')
-          fi
-          response=$(curl -sf "${KMS_ENDPOINT}/api/v3/secrets/raw?workspaceId=e1359bf4-31b4-4dfa-bb90-323e2c298ad8&secretPath=/deploy&environment=prod" \
-            -H "Authorization: Bearer ${HANZO_API_KEY}" 2>/dev/null || echo "")
-          if [ -n "$response" ]; then
-            token=$(echo "$response" | jq -r '.secrets[] | select(.secretKey=="DO_API_TOKEN") | .secretValue // empty')
-          fi
-          if [ -z "${token:-}" ]; then
-            echo "::error::Deploy credentials not found. Set HANZO_API_KEY with KMS access."
-            exit 1
-          fi
-          echo "::add-mask::${token}"
-          echo "token=${token}" >> "$GITHUB_OUTPUT"
-
-      - name: Install doctl
-        uses: digitalocean/action-doctl@v2
-        with:
-          token: ${{ steps.kms.outputs.token }}
-
-      - name: Save DigitalOcean kubeconfig (bootnode-k8s)
-        run: doctl kubernetes cluster kubeconfig save ${{ secrets.K8S_CLUSTER_NAME }}
-
-      - name: Deploy bootnode services
-        run: |
-          kubectl apply -f infra/k8s/namespace.yaml
-          kubectl apply -f infra/k8s/api-deployment.yaml
-          kubectl apply -f infra/k8s/web-deployments.yaml
-          kubectl apply -f infra/k8s/ingress.yaml
-
-          # Restart API
-          kubectl rollout restart deployment/bootnode-api -n bootnode
-          kubectl rollout status deployment/bootnode-api -n bootnode --timeout=300s
-
-          # Restart all cloud web deployments (white-label portals)
-          for deploy in $(kubectl get deployments -n bootnode -o name | grep -E 'cloud-web|web3'); do
-            kubectl rollout restart $deploy -n bootnode
-            kubectl rollout status $deploy -n bootnode --timeout=300s
-          done
-
-      - name: Save DigitalOcean kubeconfig (lux-k8s)
-        run: doctl kubernetes cluster kubeconfig save ${{ secrets.LUX_K8S_CLUSTER_NAME }}
-
-      - name: Deploy operator to lux-k8s
-        run: |
-          # Apply CRDs and RBAC
-          kubectl apply -f infra/k8s/lux/crds.yaml
-          kubectl apply -f infra/k8s/lux/rbac.yaml
-
-          # Deploy operator
-          kubectl apply -f infra/k8s/lux/operator-deployment.yaml
-          kubectl rollout status deployment/bootnode-operator -n bootnode-system --timeout=120s
+  # Build, push, and deploy are handled by docker-release.yml
+  # which triggers on CI completion via workflow_run