feat: add Harbor image build+push to CI pipeline

Build and push to harbor.mymx.me/library/derp after gitleaks
and test jobs pass. Only runs on push to master. Tags with
short SHA and latest.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -39,3 +39,23 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e . && pip install pytest
       - run: pytest -v
+
+  build:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    needs: [gitleaks, test]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Login to Harbor
+        run: >-
+          echo "${{ secrets.HARBOR_PASS }}" |
+          docker login harbor.mymx.me
+          -u "${{ secrets.HARBOR_USER }}"
+          --password-stdin
+      - name: Build and push
+        run: |
+          TAG="harbor.mymx.me/library/derp:${GITHUB_SHA::8}"
+          LATEST="harbor.mymx.me/library/derp:latest"
+          docker build -t "$TAG" -t "$LATEST" .
+          docker push "$TAG"
+          docker push "$LATEST"