Run from a published image; move source build to docker-compose.build.yaml

docker-compose.yaml now pulls git.goyban.com/goyban/whattodo so it can be used
without the source. publish.sh builds the committed version and pushes it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

publish.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Build the app image from a committed version and push it to the Gitea registry.
+# Only committed files are used (via `git archive`), so uncommitted work never ends up in the image.
+#
+#   ./publish.sh          # builds HEAD
+#   ./publish.sh v1.2     # builds a tag/branch/commit
+#
+# One-time setup: docker login git.goyban.com   (password = a Gitea token with package write access)
+set -euo pipefail
+
+REGISTRY=git.goyban.com
+IMAGE="$REGISTRY/goyban/whattodo"
+REF="${1:-HEAD}"
+
+cd "$(dirname "$0")"
+SHA="$(git rev-parse --short "$REF^{commit}")"
+
+echo "Building $IMAGE from $REF ($SHA)"
+git archive --format=tar "$REF" | docker build --target runtime -t "$IMAGE:$SHA" -t "$IMAGE:latest" -
+
+docker push "$IMAGE:$SHA"
+docker push "$IMAGE:latest"
+echo "Pushed $IMAGE:$SHA and $IMAGE:latest"