ci: remove GitHub CI — native git.hanzo.ai + cd.hanzo.ai only

This workflow ran on a self-hosted actions-runner-controller pool. ARC is
decommissioned: CI executes inside git.hanzo.ai (Gitea Actions, .hanzo/workflows)
and delivery is cd.hanzo.ai reconciling the reviewed image pin in
hanzoai/universe. GitHub is a mirror and runs nothing.

Removed rather than repointed — there is no GitHub-side pool to move to, and
leaving it would keep ARC load-bearing.

.github/workflows/release.yml

@@ -1,80 +0,0 @@
-name: Release
-
-# pack can't pack itself, so its multistage Dockerfile bootstraps the image and
-# this pushes it to GHCR. Self-contained on purpose: pack is a PUBLIC repo and
-# GitHub blocks public callers from the org's PRIVATE reusable docker-build, so
-# the build lives here. Runs on the org arcd pool (public repos allowed). A main
-# push publishes an immutable :sha-<sha7>; a semver tag publishes :vX.Y.Z and
-# moves :latest.
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  packages: write
-
-# build-push-action uploads a build-record artifact by default; a full org
-# artifact quota turns that into a hard failure that blocks the push. The record
-# is telemetry — the image is what matters. Disable it.
-env:
-  DOCKER_BUILD_SUMMARY: "false"
-  DOCKER_BUILD_RECORD_UPLOAD: "false"
-
-jobs:
-  image:
-    # Only the amd64 arcd scale set is online, and this frontend runs wherever
-    # buildkitd runs (the fabric's buildkitd is amd64). Target the pool by name;
-    # it registers hanzo-build-linux-amd64,self-hosted,Linux,X64 (no "amd64").
-    runs-on: hanzo-build-linux-amd64
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
-          driver-opts: network=host
-
-      - name: Reset Docker credential store (runner hygiene)
-        # Some arcd hosts carry a leaked Docker Desktop credsStore that breaks
-        # docker login. Reset to an empty config so the token is stored inline.
-        run: |
-          mkdir -p "$HOME/.docker"
-          printf '{}' > "$HOME/.docker/config.json"
-
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          # GH_PAT (write:packages) creates the brand-new pack package on first
-          # push; GITHUB_TOKEN is the fallback once the package exists.
-          password: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
-
-      - name: Metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/hanzoai/pack
-          # :latest tracks the most recent semver tag (latest=auto), never a
-          # branch push. Branch push -> :sha-<sha7> (immutable).
-          flavor: latest=auto
-          tags: |
-            type=semver,pattern={{version}}
-            type=sha,prefix=sha-
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          platforms: linux/amd64
-          push: true
-          provenance: false
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}