ci: publish portable containers after successful main deployment

README.md

@@ -222,10 +222,14 @@ To publish from Gitea:
 1. In the repository's Actions secrets, configure `CONTAINER_REGISTRY_USER` and
    `CONTAINER_REGISTRY_TOKEN`. Use a Gitea access token with package read/write
    permission belonging to an account allowed to publish under the repository owner.
-2. Run **Publish portable container** manually on the commit/branch to distribute.
-   The workflow runs checks, builds from committed source only, and verifies the same
-   application image with two runtime avatar/badge configurations before pushing.
-   It does not deploy to production or move a `latest` tag.
+2. Every push to `main` or `master` automatically builds and publishes the images
+   after the CI checks and production deployment succeed. Pull requests do not
+   publish images. The publication job builds from committed source only and checks
+   the same application image with two runtime configurations before pushing.
+   Missing registry secrets fail the publication job explicitly; they do not undo
+   an already successful production deployment. No `latest` tag is moved.
+   **Publish portable container** remains available for manual retries on the
+   commit/branch to distribute, without redeploying production.
 3. The images are `<gitea-host>/<owner>/<repository-lowercase>:<full-commit>` and
    `:<full-commit>-migrations`. Only the application image runs the website; the
    migrations image is used temporarily for the matching database migrations.