feat: add environment-based mutable tagging to CI templates

build-push.yaml:
- Add environment-tag and version-tag optional inputs
- Auto-detect environment from branch: main/master→:prod, staging→:staging, dev→:dev
- Replace :latest with :prod for main branch
- Support manual version tags for node-specific testing

deploy-k8s.yaml:
- Switch from image tag sed to deploy-timestamp annotation bump
- Mutable tags (:prod/:staging) stay constant in manifests
- ArgoCD detects rollout via timestamp annotation change
- Preserves SHA in commit message for traceability

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/build-push.yaml

@@ -34,6 +34,16 @@ on:
         required: false
         type: string
         default: "ubuntu-latest"
+      environment-tag:
+        description: "Mutable environment tag to push (e.g. prod, staging, dev). If empty, auto-detected from branch: main/master→prod, staging→staging, dev→dev."
+        required: false
+        type: string
+        default: ""
+      version-tag:
+        description: "Pinned version tag to push (e.g. dev-v123). Used for node-specific testing."
+        required: false
+        type: string
+        default: ""
     secrets:
       REGISTRY_USER:
         required: true
@@ -77,7 +87,11 @@ jobs:
           images: ${{ inputs.image-name }}
           tags: |
             type=sha,prefix=sha-
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=prod,enable=${{ gitea.ref == 'refs/heads/main' || gitea.ref == 'refs/heads/master' }}
+            type=raw,value=staging,enable=${{ gitea.ref == 'refs/heads/staging' }}
+            type=raw,value=dev,enable=${{ gitea.ref == 'refs/heads/dev' }}
+            type=raw,value=${{ inputs.environment-tag }},enable=${{ inputs.environment-tag != '' }}
+            type=raw,value=${{ inputs.version-tag }},enable=${{ inputs.version-tag != '' }}
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}