Build the image through hanzoai/ci

deploy.yml ran buildx on a runner with no Docker daemon, so it never
published. hanzo.yml now declares the image and cicd.yml hands it to the
build door.

Claude-Session: https://claude.ai/code/session_01HuMDfgFssPUptYUzgZ6Cp8

.github/workflows/deploy.yml

@@ -1,50 +0,0 @@
-name: deploy
-
-# Builds brand.hanzo.ai and publishes the image the operator runs. This replaces
-# the GitHub Pages workflow the repo used to carry: Pages never built that push,
-# so the host has answered 404 from our ingress the whole time. The site is
-# served by hanzoai/static behind hanzoai/ingress now, so there is no Pages and
-# no CF Pages in the path.
-#
-# The image tag is the run's commit, and the operator CR in hanzoai/universe
-# names which tag is live — a build never deploys itself.
-
-on:
-  push:
-    branches: [main]
-    paths: ['index.html', 'Dockerfile', '.github/workflows/deploy.yml']
-  workflow_dispatch:
-
-concurrency:
-  group: deploy-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  image:
-    # linux-amd64, not ubuntu-latest. This file lives in
-    # .hanzo/workflows, which GitHub never reads -- git.hanzo.ai is the only
-    # thing that can run it, and the fleet deliberately advertises no generic
-    # ubuntu-* label (~1400 mirrored forks all ask for it; one bad job was
-    # retried ~520 times across 10 runners). An unmatched label is not an
-    # error here, it is silence: the job queues until the 24h timeout, so this
-    # deploy has never produced an image and nothing ever said so.
-    runs-on: [linux-amd64]
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: build and push
-        env:
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          set -euo pipefail
-          if [ -z "${REGISTRY_TOKEN:-}" ]; then
-            echo "::error::REGISTRY_TOKEN is unset, so nothing was published. Add the org secret."
-            exit 1
-          fi
-          tag="$(git rev-parse --short HEAD)"
-          image="ghcr.io/hanzoai/brand:${tag}"
-          echo "${REGISTRY_TOKEN}" | docker login ghcr.io -u hanzo-dev --password-stdin
-          docker build -t "${image}" .
-          docker push "${image}"
-          echo "published ${image} — set spec.image.tag in universe crs/brand.yaml to ${tag}"

hanzo.yml

@@ -1,9 +1,8 @@
 # Canonical CI/CD config for hanzoai/brand — the one file both the hanzoai/ci
 # reusable (.hanzo/workflows/cicd.yml) and platform.hanzo.ai read.
 #
-# GATE ONLY: @hanzo/brand is an npm package, and the static brand site it also
-# carries already has its own lanes here (.hanzo/workflows/publish.yml,
-# deploy.yml). Declaring `images:` would build the same Dockerfile twice.
+# @hanzo/brand is an npm package; the static brand site it also carries is the
+# image declared at the end of this file, built by the build door.
 #
 # The gate is the package's own: type-check, then `pnpm test`, which builds all
 # seven tsup entries and then runs the node:test suites against the result. The
@@ -18,3 +17,11 @@ test:
       pnpm install --frozen-lockfile
       pnpm type-check
       pnpm test
+
+# Built by the build door, one BuildKit Job per platform.
+images:
+  - name: brand
+    context: .
+    dockerfile: Dockerfile
+    repo: ghcr.io/hanzoai/brand
+    platforms: [linux/amd64]