Build the image through hanzoai/ci

docker-release.yml ran buildx on a runner with no Docker daemon, so it
never published. hanzo.yml now declares the image and cicd.yml hands it
to the build door.

Claude-Session: https://claude.ai/code/session_01HuMDfgFssPUptYUzgZ6Cp8

.github/workflows/cicd.yml

@@ -0,0 +1,27 @@
+name: CI/CD
+
+# Triggers and the import, nothing else: hanzo.yml says what is built, and
+# hanzoai/ci builds it (images through the build door, one BuildKit Job per
+# platform).
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+  workflow_dispatch:
+
+# A called workflow cannot exceed its caller's token: the image push and a
+# tag's release assets are the two scopes the pipeline writes with.
+permissions:
+  contents: write
+  packages: write
+
+concurrency:
+  group: cicd-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cicd:
+    uses: hanzoai/ci/.github/workflows/build.yml@v2
+    secrets: inherit

.github/workflows/docker-release.yml

@@ -1,18 +0,0 @@
-name: Docker Release
-
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-
-jobs:
-  docker:
-    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
-    with:
-      image: ghcr.io/hanzoai/sql-meta
-    secrets: inherit

.hanzo/workflows/cicd.yml

@@ -1,15 +0,0 @@
-# Canonical caller — every knob lives in /hanzo.yml, none here.
-# Runs on the git-runner fleet at git.hanzo.ai, the only pool serving these
-# labels. github.com resolves only .github/workflows and has no runner for
-# them, so a caller placed there is a gate that cannot be scheduled.
-name: CI/CD
-on:
-  push:
-    branches: [main]
-    tags: ['v*']
-  pull_request:
-  workflow_dispatch:
-jobs:
-  cicd:
-    uses: hanzoai/ci/.hanzo/workflows/build.yml@v1
-    secrets: inherit