feat: Push firmware to Harbor for Trivy scanning

Add crane-based OCI image push step to CI workflow.
Packages firmware binary into scratch image and pushes to
harbor.mymx.me/library/firmware:<sha> on every build.
Tag pushes also get a version tag. Harbor auto-scans with Trivy.

.gitea/workflows/lint.yml

@@ -90,6 +90,29 @@ jobs:
           cd get-started/csi_recv_router
           idf.py size-components 2>/dev/null | head -30
 
+      - name: Push to Harbor
+        run: |
+          CRANE_VERSION="v0.20.3"
+          curl -sL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz" \
+            | tar xz -C /usr/local/bin crane
+
+          BIN="get-started/csi_recv_router/build/csi_recv_router.bin"
+          TAG=$(echo "${{ github.sha }}" | cut -c1-7)
+          IMAGE="harbor.mymx.me/library/firmware"
+
+          crane auth login harbor.mymx.me \
+            -u "${{ secrets.HARBOR_USER }}" \
+            -p "${{ secrets.HARBOR_PASS }}"
+
+          tar cf /tmp/firmware.tar -C "$(dirname "$BIN")" "$(basename "$BIN")"
+          crane append -f /tmp/firmware.tar -t "$IMAGE:$TAG"
+
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+            crane tag "$IMAGE:$TAG" "${{ github.ref_name }}"
+          fi
+
+          echo "Pushed $IMAGE:$TAG"
+
       - name: Create release
         if: startsWith(github.ref, 'refs/tags/v')
         run: |