feat: add environment-based image tags (prod/staging/dev) to CI templates

build-push.yaml now pushes branch-conditional env tags alongside SHA tags:
- main/master → prod, staging → staging, dev → dev
- Optional version input for pinned dev-v{N} tags
- New env-tag output for downstream consumers

deploy-k8s.yaml adds use-env-tag option:
- When true, skips SHA-based manifest updates and instead bumps a deploy
  annotation so ArgoCD rolls pods with the mutable tag
- Backward compatible: existing services using SHA tags are unaffected

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -29,6 +29,11 @@ on:
         required: false
         type: string
         default: ""
+      version:
+        description: "Optional version for pinned dev tags (e.g. '123' produces 'dev-v123'). Only applies on dev branch."
+        required: false
+        type: string
+        default: ""
       runner:
         description: "Runner label to use (e.g. ubuntu-latest, self-hosted-arm64). ARM64 builds use QEMU emulation on amd64 runners by default — set this to a native ARM64 runner for faster Rust/heavy builds."
         required: false
@@ -43,6 +48,9 @@ on:
       image-tag:
         description: "The sha-based image tag that was pushed"
         value: ${{ jobs.build.outputs.image-tag }}
+      env-tag:
+        description: "The environment tag that was pushed (prod, staging, dev, or dev-v{N})"
+        value: ${{ jobs.build.outputs.env-tag }}
 
 jobs:
   build:
@@ -53,6 +61,7 @@ jobs:
       options: --privileged
     outputs:
       image-tag: ${{ steps.tag.outputs.tag }}
+      env-tag: ${{ steps.tag.outputs.env-tag }}
     steps:
       - uses: actions/checkout@v4
 
@@ -64,6 +73,28 @@ jobs:
           SHORT_SHA="${SHORT_SHA:0:7}"
           echo "tag=sha-${SHORT_SHA}" >> "$GITEA_OUTPUT"
 
+          # Determine environment tag from branch
+          REF="${{ gitea.ref }}"
+          VERSION="${{ inputs.version }}"
+          case "$REF" in
+            refs/heads/main|refs/heads/master)
+              echo "env-tag=prod" >> "$GITEA_OUTPUT"
+              ;;
+            refs/heads/staging)
+              echo "env-tag=staging" >> "$GITEA_OUTPUT"
+              ;;
+            refs/heads/dev)
+              if [ -n "$VERSION" ]; then
+                echo "env-tag=dev-v${VERSION}" >> "$GITEA_OUTPUT"
+              else
+                echo "env-tag=dev" >> "$GITEA_OUTPUT"
+              fi
+              ;;
+            *)
+              echo "env-tag=" >> "$GITEA_OUTPUT"
+              ;;
+          esac
+
       - name: Log in to Gitea registry
         uses: docker/login-action@v3
         with:
@@ -79,6 +110,7 @@ jobs:
           tags: |
             type=sha,prefix=sha-
             type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=${{ steps.tag.outputs.env-tag }},enable=${{ steps.tag.outputs.env-tag != '' }}
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}