fix(ci): publish registry blobs in bounded chunks

README.md

@@ -244,6 +244,13 @@ by installations; existing remco image tags are not moved automatically.
    `:<full-commit>-migrations`. Only the application image runs the website; the
    migrations image is used temporarily for the matching database migrations.
 
+Publication uses checksum-pinned regctl v0.11.6 with 8 MiB blob requests to
+avoid monolithic layer uploads exceeding reverse-proxy limits. Both images are
+exported and uploaded sequentially; temporary archives and credentials are removed
+on exit. The runner needs curl, sha256sum and temporary disk space for one Docker
+image archive. The remote image config digest is checked against the local image
+after each upload. A proxy must still allow the OCI registry PATCH/PUT endpoints.
+
 For this repository the image base is
 `gitlab.epicnabbo.nl/simo/epicnext-cms`. Package access is controlled by Gitea.
 For private packages, run `docker login gitlab.epicnabbo.nl` on the installation