feat(cms): improve catalog, editorial recovery and operations

scripts/publish-container.sh

@@ -21,7 +21,17 @@ trap 'rm -rf -- "$DOCKER_CONFIG" "$context"' EXIT
 git archive HEAD | tar -x -C "$context"
 printf '%s' "$REGISTRY_TOKEN" | docker login "$registry" --username "$REGISTRY_USER" --password-stdin
 unset REGISTRY_TOKEN
-docker build --network=host --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" "$context"
+# On the shared runner, publish the exact image already verified by deployment.
+local_image="epicnext-cms:$sha"
+local_revision="$(docker image inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$local_image" 2>/dev/null || true)"
+local_id="$(docker image inspect --format '{{.Id}}' "$local_image" 2>/dev/null || true)"
+verified_id="$(docker image inspect --format '{{.Id}}' "epicnext-cms:verified-$sha" 2>/dev/null || true)"
+if [[ "$local_revision" = "$sha" && -n "$local_id" && "$local_id" = "$verified_id" ]]; then
+  docker tag "$verified_id" "$image"
+  echo "Reusing verified release image $local_image"
+else
+  docker build --network=host --build-arg NEXT_DEPLOYMENT_ID="$sha" -t "$image" "$context"
+fi
 docker build --network=host --target migrations -t "$image-migrations" "$context"
 node scripts/verify-portable-image.mjs "$image" "$sha"
 # Publish only after the same application image passed both runtime configurations.