ci: make docker-release.yml self-contained (drop cross-org reusable)

bootnode can't access hanzoai/.github's org-scoped reusable workflow, so inline
the build on the same self-hosted arcd runners ([self-hosted, linux, amd64]) it
used before May 19 — builds api + web, pushes api-latest/web-latest (universe's
pins) + sha + version tags. Restores the GHA fallback without the cross-org
access change; platform-native (.platform.yml) remains the canonical path.

.github/workflows/docker-release.yml

@@ -1,63 +1,67 @@
-# Deployment managed by hanzoai/universe — this workflow only builds and pushes images
+# Self-contained image build on the self-hosted arcd pools.
+#
+# Previously this delegated to hanzoai/.github's reusable docker-build.yml, but
+# bootnode is in a separate GitHub org and that workflow's access is org-scoped,
+# so every run failed "workflow was not found" (broken since ~2026-05-19). The
+# build steps are inlined here — same self-hosted runners, no cross-org
+# reusable dependency. (platform.hanzo.ai via .platform.yml is the canonical
+# path; this is the retained GHA fallback. No GitHub-hosted runners.)
 name: Docker Release
 
 on:
-  # Only build after CI passes on main
-  workflow_run:
-    workflows: ["CI"]
-    types: [completed]
-    branches: [main]
-  # Tags build directly (release cuts)
   push:
+    branches: [main]
     tags: ["v*"]
-  # Manual override
   workflow_dispatch:
 
 concurrency:
-  group: docker-${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.ref }}
+  group: docker-release-${{ github.ref }}
   cancel-in-progress: false
 
 permissions:
   contents: read
   packages: write
-  id-token: write
 
 jobs:
-  # Gate: only proceed if CI passed (skip check for tags/manual)
-  gate:
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'workflow_run' ||
-      github.event.workflow_run.conclusion == 'success'
+  build:
+    runs-on: [self-hosted, linux, amd64]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { app: api, context: ./api }
+          - { app: web, context: ./web }
     steps:
-      - run: echo "CI passed — proceeding with Docker build"
+      - uses: actions/checkout@v4
 
-  # Build API image via standard Hanzo reusable workflow
-  # NOTE: pushed under the `bootnode` package with `-api` tag suffix so it
-  # doesn't collide with web's tags in the same package.
-  api:
-    needs: gate
-    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
-    with:
-      image: ghcr.io/hanzoai/bootnode
-      context: ./api
-      dockerfile: Dockerfile
-      platforms: "linux/amd64"
-      tag-suffix: -api
-    secrets: inherit
+      - uses: docker/setup-buildx-action@v3
 
-  # Build Web image via standard Hanzo reusable workflow
-  # NOTE: pushed under the `bootnode` package (not `bootnode-web`) with `web-`
-  # tag prefix because GHCR auto-creation of `bootnode-web` package fails 403
-  # when the GH org has no policy allowing first-push package creation.
-  # Deployment image: ghcr.io/hanzoai/bootnode:web-<sha>|web-latest
-  web:
-    needs: gate
-    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
-    with:
-      image: ghcr.io/hanzoai/bootnode
-      context: ./web
-      dockerfile: Dockerfile
-      platforms: "linux/amd64"
-      tag-suffix: -web
-    secrets: inherit
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compute tags
+        id: tags
+        run: |
+          BASE=ghcr.io/hanzoai/bootnode
+          SHORT=$(echo "${{ github.sha }}" | cut -c1-7)
+          # *-latest is what hanzo/universe pins; sha tag is for traceability.
+          TAGS="$BASE:${{ matrix.app }}-latest,$BASE:sha-${SHORT}-amd64-${{ matrix.app }}"
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+            V="${{ github.ref_name }}"; V="${V#v}"
+            TAGS="$TAGS,$BASE:${V}-amd64-${{ matrix.app }}"
+          fi
+          echo "tags=$TAGS" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push ${{ matrix.app }}
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.context }}/Dockerfile
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          platforms: linux/amd64
+          provenance: false