fix(ci): restore preflight image cleanup marker and remove obsolete publish-container tests

- Restore build_attempted=1 in ci-preflight.sh so the exit trap
  removes the temporary image tag
- Remove publish-container.test.ts and its harness (publication
  workflow and script were removed in fff284aa)
- Update deploy-workflow-contract and docker-build-contract tests
  to assert that publication has been removed

src/lib/deploy-workflow-contract.test.ts

@@ -54,16 +54,7 @@ it("builds the checked out source without fetching a moving remote branch", () =
 	expect(dockerfile).not.toMatch(/^RUN\s+git\s+(?:pull|fetch|clone)\b/m);
 });
 
-it("publishes commit images after successful main deployment and preserves manual retries", () => {
-	const publish = workflow.slice(workflow.indexOf("\n  publish-container:"));
-	expect(publish).toContain("needs: deploy");
-	expect(publish).toContain("gitea.event_name == 'push'");
-	expect(publish).toContain("gitea.ref_name == 'main'");
-	expect(publish).toContain("gitea.ref_name == 'master'");
-	expect(publish).toContain("bash scripts/publish-container.sh");
-	expect(publish).toContain("secrets.CONTAINER_REGISTRY_USER");
-	expect(publish).toContain("secrets.CONTAINER_REGISTRY_TOKEN");
-	const manual = readFileSync(".gitea/workflows/container.yaml", "utf8");
-	expect(manual).toContain("workflow_dispatch:");
-	expect(manual).not.toMatch(/^ {2}push:/m);
+it("no longer publishes container images in CI", () => {
+	expect(workflow).not.toContain("publish-container");
+	expect(workflow).not.toContain("publish-container.sh");
 });